@adaas/are 0.0.2 → 0.0.4

package/dist/node/lib/AreSyntax/AreSyntax.context.js

@@ -11,107 +11,339 @@ var __decorateClass = (decorators, target, key, kind) => {
       result = (decorator(result)) || result;
   return result;
 };
-exports.AreSyntaxContext = class AreSyntaxContext extends aConcept.A_Fragment {
-  constructor(config = {}) {
-    super({ name: "AreSyntaxContext" });
-    this.config = config;
+exports.AreSyntax = class AreSyntax extends aConcept.A_Fragment {
+  constructor(config) {
+    super({ name: "AreSyntax" });
+    /**
+     * Max allowed length of an expression string to prevent excessively long inputs that could lead to performance issues or abuse.
+     */
+    this.MAX_LENGTH = 500;
+    /**
+     * Max allowed nesting depth of parentheses, brackets, and braces in expressions to prevent excessively complex inputs that could lead to performance issues or abuse. Default is 5 levels of nesting.
+     */
+    this.MAX_DEPTH = 5;
+    /**
+     * List of regex patterns that are blocked in expressions to prevent access to unsafe or sensitive features. This includes patterns for global objects, functions, and syntax that could be used for malicious purposes (e.g. "eval", "Function", "fetch", "XMLHttpRequest", "import", "require", "document", "window", "globalThis", "global", "process", "__proto__", "constructor", "prototype"). Expressions containing any of these patterns will be rejected during validation.
+     */
+    this.BLOCKED_PATTERNS = [
+      /\beval\b/,
+      /\bFunction\b/,
+      /\bfetch\b/,
+      /\bXMLHttpRequest\b/,
+      /\bimport\b/,
+      /\brequire\b/,
+      /\bdocument\b/,
+      /\bwindow\b/,
+      /\bglobalThis\b/,
+      /\bglobal\b/,
+      /\bprocess\b/,
+      /\b__proto__\b/,
+      /\bprototype\b/,
+      /\bconstructor\b/,
+      /\bObject\s*\.\s*assign\b/,
+      /\bObject\s*\.\s*defineProperty\b/,
+      /\bsetTimeout\b/,
+      /\bsetInterval\b/,
+      /\blocalStorage\b/,
+      /\bsessionStorage\b/,
+      /\bcookie\b/,
+      /\bWebSocket\b/,
+      /\bWorker\b/
+    ];
+    /**
+     * Set of global identifiers that are blocked in expressions to prevent access to unsafe or sensitive features. This includes global objects and functions that could be used for malicious purposes (e.g. "eval", "Function", "fetch", "XMLHttpRequest", "document", "window", "globalThis", "global", "process", "setTimeout", "setInterval", "localStorage", "sessionStorage", "indexedDB", "WebSocket", "Worker"). Accessing any of these identifiers in an expression will be rejected during validation.
+     */
+    this.BLOCKED_GLOBALS = /* @__PURE__ */ new Set([
+      "eval",
+      "Function",
+      "fetch",
+      "XMLHttpRequest",
+      "document",
+      "window",
+      "globalThis",
+      "global",
+      "process",
+      "setTimeout",
+      "setInterval",
+      "clearTimeout",
+      "clearInterval",
+      "localStorage",
+      "sessionStorage",
+      "indexedDB",
+      "WebSocket",
+      "Worker",
+      "Blob",
+      "File",
+      "require",
+      "module",
+      "exports",
+      "alert",
+      "confirm",
+      "prompt"
+    ]);
+    /**
+     * Regex pattern that defines the allowed characters in expressions. This pattern allows letters, digits, whitespace, and common operators and punctuation used in JavaScript expressions. Expressions containing characters that do not match this pattern will be rejected during validation to prevent injection of potentially harmful code.
+     */
+    this.ALLOWED_CHARS = /^[\w\s\d\.\[\]()=><|&!+\-*/%?:,'"`;~^$]+$/;
+    /**
+     * Simple dot-path identifier pattern (e.g. "name", "user.name", "user.profile.name").
+     * Matches strings that consist solely of identifier characters separated by dots.
+     */
+    this.SIMPLE_PATH = /^[a-zA-Z_$][\w$]*(?:\.[a-zA-Z_$][\w$]*)*$/;
+    this._trimWhitespace = config?.trimWhitespace !== false;
+    this._strictMode = config?.strictMode !== false;
+    this._rules = [...config?.rules ?? []].sort(
+      (a, b) => (b.priority ?? 0) - (a.priority ?? 0)
+    );
   }
   /**
-   * identifier of the root tag to use when compiling in browser context.
-   * 
-   * @return {string} The root tag identifier.
+   * Get the array of token rules that define the syntax for parsing templates. Each rule specifies how to identify and process a particular type of token (e.g. interpolation, directive, comment) within templates. The rules are checked in order of priority, allowing for flexible and customizable parsing behavior.
    */
-  get rootTag() {
-    return this.config.rootTag || "are-root";
+  get rules() {
+    return this._rules;
   }
   /**
-   * List of standard HTML tags to recognize.
-   * [!] This is a set of tags that can be ignored when determining if a node is a custom component.
-   * 
-   * @return {Set<string>} A set of standard HTML tag names.
+   * Indicates whether leading and trailing whitespace should be trimmed from token content. When enabled, any whitespace at the start or end of the content captured by a token will be removed before further processing. This can help prevent issues with unintended spaces affecting rendering or logic, especially in cases like interpolations or directives where extra whitespace may be common. Default is true.
    */
-  get standardTags() {
-    return new Set(this.config.standardTags || []);
+  get trimWhitespace() {
+    return this._trimWhitespace;
   }
   /**
-   * Enable or disable debug mode for syntax parsing.
-   * When enabled, additional debug information will be logged during parsing.
-   * 
-   * @return {boolean} True if debug mode is enabled, false otherwise.
+   * Indicates whether the parser should throw an error when it encounters unclosed tokens. When enabled, if the parser finds an opening delimiter without a corresponding closing delimiter (e.g. an unclosed interpolation or directive), it will throw an error instead of silently ignoring it. This can help catch syntax errors and ensure that templates are well-formed. Default is true.
    */
-  get debugMode() {
-    return this.config.debugMode || false;
+  get strictMode() {
+    return this._strictMode;
   }
   /**
-   * Custom interpolation delimiters for template parsing.
-   * Default is ['{{', '}}'].
-   * 
-   * @return {[string, string]} The opening and closing interpolation delimiters.
+   * Compiles an expression string into a reusable executor.
+   * Performs validation and Function construction once.
+   * Use when the same expression will be evaluated multiple times
+   * e.g. event handlers, instructions that re-apply on store changes.
+   *
+   * @example
+   *   // compile once at apply() time
+   *   const compiled = AreCommonHelper.compile('(e) => !!pageTitle ? $testHandler(e, item) : null')
+   *
+   *   // execute on every click — no re-parsing, no re-validation
+   *   element.addEventListener('click', (e) => {
+   *       const fn = compiled.execute(store, { $testHandler: handler, item })
+   *       if (typeof fn === 'function') fn(e)
+   *   })
    */
-  get interpolationDelimiters() {
-    return this.config.interpolationDelimiters || ["{{", "}}"];
+  compile(expr) {
+    const trimmed = expr.trim();
+    this.validate(trimmed);
+    const isCallable = this.isCallableExpression(trimmed);
+    const isSimplePath = this.SIMPLE_PATH.test(trimmed);
+    let compiled = null;
+    if (!isSimplePath) {
+      try {
+        compiled = new Function("scope", `"use strict"; with(scope) { return (${trimmed}) }`);
+      } catch (e) {
+        throw new Error(`Expression syntax error in "${trimmed}": ${e.message}`);
+      }
+    }
+    const createSandboxFn = this.createSandbox.bind(this);
+    return {
+      isCallable,
+      execute(store, scope) {
+        if (isSimplePath) {
+          if (scope && trimmed in scope) return scope[trimmed];
+          const value = store.get(trimmed);
+          if (value !== void 0) return value;
+        }
+        const sandbox = createSandboxFn(store, scope);
+        let result;
+        try {
+          result = compiled ? compiled(sandbox) : new Function("scope", `"use strict"; with(scope) { return (${trimmed}) }`)(sandbox);
+        } catch (e) {
+          throw new Error(`Expression evaluation error in "${trimmed}": ${e.message}`);
+        }
+        if (isCallable && typeof result !== "function") {
+          throw new Error(
+            `Expression "${trimmed}" was expected to be callable \u2014 got ${result === null ? "null" : typeof result}`
+          );
+        }
+        return result;
+      }
+    };
   }
   /**
-   * Custom binding delimiter for data binding parsing.
-   * Default is ':'.
-   * @return {string} The binding delimiter.
+   * Evaluates an expression string against the provided store.
+   * Automatically determines whether the result should be callable
+   * based on the shape of the expression.
+   *
+   * Returns the raw value for plain expressions (interpolations, bindings).
+   * Returns a bound function for callable expressions (event handlers).
+   *
+   * @param expr  Expression string to evaluate.
+   * @param store AreStore used for identifier resolution.
+   * @param scope Optional extra bindings checked **before** the store.
+   *              Useful for injecting event-specific values (`$event`, `element`)
+   *              or emit wrappers (`$handleClick`).
+   *
+   * @example
+   *   // simple value
+   *   evaluate('user.name', store)
+   *
+   *   // with emit wrapper
+   *   evaluate('$handleClick($event, user.name)', store, {
+   *       $event: domEvent,
+   *       $handleClick: (...args) => node.emit(new AreEvent('handleClick', args)),
+   *   })
+   *
+   *   // arrow with conditional
+   *   evaluate('(e) => isValid(user.name) ? $handleClick(e) : null', store, {
+   *       $handleClick: (...args) => node.emit(new AreEvent('handleClick', args)),
+   *   })
    */
-  get bindingDelimiter() {
-    return this.config.bindingDelimiter || ":";
+  evaluate(expr, store, scope) {
+    const trimmed = expr.trim();
+    this.validate(trimmed);
+    if (this.SIMPLE_PATH.test(trimmed)) {
+      if (scope && trimmed in scope) return scope[trimmed];
+      const value = store.get(trimmed);
+      if (value !== void 0) return value;
+    }
+    const sandbox = this.createSandbox(store, scope);
+    const result = this.execute(trimmed, sandbox);
+    if (this.isCallableExpression(trimmed)) {
+      if (typeof result !== "function") {
+        throw new Error(
+          `Expression "${trimmed}" was expected to be callable \u2014 got ${result === null ? "null" : typeof result}`
+        );
+      }
+    }
+    return result;
   }
   /**
-   * Custom listener delimiter for event binding parsing.
-   * Default is '@'.
-   * 
-   * @return {string} The listener delimiter.
+   * Extracts $-prefixed handler names from an expression.
+   * These represent event emission targets, not store references.
+   *
+   * Examples:
+   *   "$handleClick"                                     → Set(["handleClick"])
+   *   "$handleClick(user.name)"                           → Set(["handleClick"])
+   *   "(e) => isValid(user.name) ? $handleClick(e) : null" → Set(["handleClick"])
    */
-  get listenerDelimiter() {
-    return this.config.listenerDelimiter || "@";
+  extractEmitHandlers(expr) {
+    const stripped = expr.trim().replace(/'[^']*'|"[^"]*"|`[^`]*`/g, '""');
+    const handlers = /* @__PURE__ */ new Set();
+    const pattern = /\$([a-zA-Z_][\w$]*)/g;
+    let match;
+    while ((match = pattern.exec(stripped)) !== null) {
+      handlers.add(match[1]);
+    }
+    return handlers;
   }
-  /**
-   * Enable or disable strict mode for syntax parsing.
-   * When enabled, the parser will throw errors for any syntax violations.
-   * Default is true.
-   * 
-   * @return {boolean} True if strict mode is enabled, false otherwise.
-   */
-  get strictMode() {
-    return this.config.strictMode !== false;
+  // ── Classification ────────────────────────────────────────────────────────
+  isCallableExpression(expr) {
+    if (/^\(?[\w\s,]*\)?\s*=>/.test(expr)) return true;
+    if (/^function\s*\(/.test(expr)) return true;
+    return false;
   }
-  /**
-   * Enable or disable whitespace trimming in templates.
-   * When enabled, leading and trailing whitespace in template expressions will be trimmed.
-   * Default is true.
-   * 
-   * @return {boolean} True if whitespace trimming is enabled, false otherwise.
-   */
-  get trimWhitespace() {
-    return this.config.trimWhitespace !== false;
+  // ── Validation ────────────────────────────────────────────────────────────
+  validate(expr) {
+    if (expr.length > this.MAX_LENGTH) {
+      throw new Error(
+        `Expression exceeds maximum length of ${this.MAX_LENGTH} characters`
+      );
+    }
+    for (const pattern of this.BLOCKED_PATTERNS) {
+      if (pattern.test(expr)) {
+        throw new Error(`Expression contains blocked pattern: ${pattern.source}`);
+      }
+    }
+    if (!this.ALLOWED_CHARS.test(expr)) {
+      throw new Error(`Expression contains disallowed characters`);
+    }
+    this.checkDepth(expr);
   }
-  /**
-   * Custom directive delimiter for directive parsing.
-   * Default is '$'.
-   * 
-   * @return {string} The directive delimiter.
-   */
-  get directiveDelimiter() {
-    return this.config.directiveDelimiter || "$";
+  checkDepth(expr) {
+    let depth = 0;
+    let max = 0;
+    for (const ch of expr) {
+      if (ch === "(" || ch === "[" || ch === "{") {
+        depth++;
+        max = Math.max(max, depth);
+      }
+      if (ch === ")" || ch === "]" || ch === "}") depth--;
+    }
+    if (max > this.MAX_DEPTH) {
+      throw new Error(`Expression exceeds maximum nesting depth of ${this.MAX_DEPTH}`);
+    }
   }
-  /*
-   * A list of custom directives to be recognized by the syntax parser.
-   * Each directive should be a string representing the directive name.
-   * Default is an empty array.
-   */
-  get customDirectives() {
-    return this.config.customDirectives || [];
+  // ── Sandbox ───────────────────────────────────────────────────────────────
+  createSandbox(store, scope) {
+    return new Proxy({}, {
+      has: (_, key) => {
+        if (typeof key === "string" && this.BLOCKED_GLOBALS.has(key)) return false;
+        return true;
+      },
+      get: (_, key) => {
+        if (typeof key !== "string") return void 0;
+        if (scope && key in scope) return scope[key];
+        this.assertSafeKey(key);
+        const value = store.get(key);
+        if (typeof value === "function") return value.bind(store);
+        if (value !== null && typeof value === "object" && value !== void 0) {
+          return new Proxy(value, this.nestedHandler(key, store));
+        }
+        return value;
+      },
+      set: () => {
+        throw new Error("Expression scope is read-only");
+      }
+    });
+  }
+  nestedHandler(prefix, store) {
+    return {
+      has: () => true,
+      get: (target, key) => {
+        if (typeof key !== "string") return void 0;
+        this.assertSafeKey(key);
+        const fullKey = `${prefix}.${key}`;
+        const value = store.get(fullKey);
+        if (value === void 0) return target[key];
+        if (typeof value === "function") return value.bind(store);
+        if (value !== null && typeof value === "object") {
+          return new Proxy(value, this.nestedHandler(fullKey, store));
+        }
+        return value;
+      },
+      set: () => {
+        throw new Error("Expression scope is read-only");
+      }
+    };
+  }
+  assertSafeKey(key) {
+    if (key === "__proto__" || key === "constructor" || key === "prototype") {
+      throw new Error(`Access to "${key}" is not allowed in expressions`);
+    }
+    if (this.BLOCKED_GLOBALS.has(key)) {
+      throw new Error(`Access to "${key}" is not allowed in expressions`);
+    }
+  }
+  // ── Execution ─────────────────────────────────────────────────────────────
+  execute(expr, sandbox) {
+    let fn;
+    try {
+      fn = new Function("scope", `with(scope) { return (${expr}) }`);
+    } catch (e) {
+      throw new Error(`Expression syntax error in "${expr}": ${e.message}`);
+    }
+    try {
+      return fn(sandbox);
+    } catch (e) {
+      throw new Error(`Expression evaluation error in "${expr}": ${e.message}`);
+    }
   }
 };
-exports.AreSyntaxContext = __decorateClass([
+exports.AreSyntax = __decorateClass([
   aFrame.A_Frame.Fragment({
     namespace: "A-ARE",
     name: "AreSyntaxContext",
     description: "Context that defines the syntax rules and structures for the A-Concept Rendering Engine (ARE). It provides mechanisms for parsing and interpreting templates, attributes, directives, interpolations, and event listeners, enabling dynamic and interactive UI rendering within the ARE framework."
   })
-], exports.AreSyntaxContext);
+], exports.AreSyntax);
 //# sourceMappingURL=AreSyntax.context.js.map
 //# sourceMappingURL=AreSyntax.context.js.map

package/dist/node/lib/AreSyntax/AreSyntax.context.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../../../src/lib/AreSyntax/AreSyntax.context.ts"],"names":["AreSyntaxContext","A_Fragment","A_Frame"],"mappings":";;;;;;;;;;;;;AASaA,wBAAA,GAAN,+BAA+BC,mBAAA,CAAW;AAAA,EAG7C,WAAA,CAIuB,MAAA,GAAwC,EAAC,EAC9D;AACE,IAAA,KAAA,CAAM,EAAE,IAAA,EAAM,kBAAA,EAAoB,CAAA;AAFf,IAAA,IAAA,CAAA,MAAA,GAAA,MAAA;AAAA,EAIvB;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAQA,IAAI,OAAA,GAAkB;AAClB,IAAA,OAAO,IAAA,CAAK,OAAO,OAAA,IAAW,UAAA;AAAA,EAClC;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOA,IAAI,YAAA,GAA4B;AAC5B,IAAA,OAAO,IAAI,GAAA,CAAI,IAAA,CAAK,MAAA,CAAO,YAAA,IAAgB,EAAE,CAAA;AAAA,EACjD;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOA,IAAI,SAAA,GAAqB;AACrB,IAAA,OAAO,IAAA,CAAK,OAAO,SAAA,IAAa,KAAA;AAAA,EACpC;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOA,IAAI,uBAAA,GAA4C;AAC5C,IAAA,OAAO,IAAA,CAAK,MAAA,CAAO,uBAAA,IAA2B,CAAC,MAAM,IAAI,CAAA;AAAA,EAC7D;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAMA,IAAI,gBAAA,GAA2B;AAC3B,IAAA,OAAO,IAAA,CAAK,OAAO,gBAAA,IAAoB,GAAA;AAAA,EAC3C;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOA,IAAI,iBAAA,GAA4B;AAC5B,IAAA,OAAO,IAAA,CAAK,OAAO,iBAAA,IAAqB,GAAA;AAAA,EAC5C;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAQA,IAAI,UAAA,GAAsB;AACtB,IAAA,OAAO,IAAA,CAAK,OAAO,UAAA,KAAe,KAAA;AAAA,EACtC;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAQA,IAAI,cAAA,GAA0B;AAC1B,IAAA,OAAO,IAAA,CAAK,OAAO,cAAA,KAAmB,KAAA;AAAA,EAC1C;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOA,IAAI,kBAAA,GAA6B;AAC7B,IAAA,OAAO,IAAA,CAAK,OAAO,kBAAA,IAAsB,GAAA;AAAA,EAC7C;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOA,IAAI,gBAAA,GAA6B;AAC7B,IAAA,OAAO,IAAA,CAAK,MAAA,CAAO,gBAAA,IAAoB,EAAC;AAAA,EAC5C;AACJ;AAxGaD,wBAAA,GAAN,eAAA,CAAA;AAAA,EALNE,eAAQ,QAAA,CAAS;AAAA,IACd,SAAA,EAAW,OAAA;AAAA,IACX,IAAA,EAAM,kBAAA;AAAA,IACN,WAAA,EAAa;AAAA,GAChB;AAAA,CAAA,EACYF,wBAAA,CAAA","file":"AreSyntax.context.js","sourcesContent":["import { A_Fragment } from \"@adaas/a-concept\";\nimport { A_Frame } from \"@adaas/a-frame\";\nimport { AreSyntaxInitOptions } from \"./AreSyntax.types\";\n\n@A_Frame.Fragment({\n    namespace: 'A-ARE',\n    name: 'AreSyntaxContext',\n    description: 'Context that defines the syntax rules and structures for the A-Concept Rendering Engine (ARE). It provides mechanisms for parsing and interpreting templates, attributes, directives, interpolations, and event listeners, enabling dynamic and interactive UI rendering within the ARE framework.'\n})\nexport class AreSyntaxContext extends A_Fragment {\n\n\n    constructor(\n        /**\n         * Initialization options for configuring the AreSyntax context.\n         */\n        protected readonly config: Partial<AreSyntaxInitOptions> = {}\n    ) {\n        super({ name: 'AreSyntaxContext' });\n\n    }\n\n\n    /**\n     * identifier of the root tag to use when compiling in browser context.\n     * \n     * @return {string} The root tag identifier.\n     */\n    get rootTag(): string {\n        return this.config.rootTag || 'are-root';\n    }\n    /**\n     * List of standard HTML tags to recognize.\n     * [!] This is a set of tags that can be ignored when determining if a node is a custom component.\n     * \n     * @return {Set<string>} A set of standard HTML tag names.\n     */\n    get standardTags(): Set<string> {\n        return new Set(this.config.standardTags || [])\n    };\n    /**\n     * Enable or disable debug mode for syntax parsing.\n     * When enabled, additional debug information will be logged during parsing.\n     * \n     * @return {boolean} True if debug mode is enabled, false otherwise.\n     */\n    get debugMode(): boolean {\n        return this.config.debugMode || false;\n    }\n    /**\n     * Custom interpolation delimiters for template parsing.\n     * Default is ['{{', '}}'].\n     * \n     * @return {[string, string]} The opening and closing interpolation delimiters.\n     */\n    get interpolationDelimiters(): [string, string] {\n        return this.config.interpolationDelimiters || ['{{', '}}'];\n    }\n    /**\n     * Custom binding delimiter for data binding parsing.\n     * Default is ':'.\n     * @return {string} The binding delimiter.\n     */\n    get bindingDelimiter(): string {\n        return this.config.bindingDelimiter || ':';\n    }\n    /**\n     * Custom listener delimiter for event binding parsing.\n     * Default is '@'.\n     * \n     * @return {string} The listener delimiter.\n     */\n    get listenerDelimiter(): string {\n        return this.config.listenerDelimiter || '@';\n    }\n    /**\n     * Enable or disable strict mode for syntax parsing.\n     * When enabled, the parser will throw errors for any syntax violations.\n     * Default is true.\n     * \n     * @return {boolean} True if strict mode is enabled, false otherwise.\n     */\n    get strictMode(): boolean {\n        return this.config.strictMode !== false;\n    }\n    /**\n     * Enable or disable whitespace trimming in templates.\n     * When enabled, leading and trailing whitespace in template expressions will be trimmed.\n     * Default is true.\n     * \n     * @return {boolean} True if whitespace trimming is enabled, false otherwise.\n     */\n    get trimWhitespace(): boolean {\n        return this.config.trimWhitespace !== false;\n    }\n    /**\n     * Custom directive delimiter for directive parsing.\n     * Default is '$'.\n     * \n     * @return {string} The directive delimiter.\n     */\n    get directiveDelimiter(): string {\n        return this.config.directiveDelimiter || '$';\n    }\n\n    /*\n     * A list of custom directives to be recognized by the syntax parser.\n     * Each directive should be a string representing the directive name.\n     * Default is an empty array.\n     */\n    get customDirectives(): string[] {\n        return this.config.customDirectives || [];\n    }\n}"]}
+{"version":3,"sources":["../../../../src/lib/AreSyntax/AreSyntax.context.ts"],"names":["AreSyntax","A_Fragment","A_Frame"],"mappings":";;;;;;;;;;;;;AAUaA,iBAAA,GAAN,wBAAwBC,mBAAA,CAAW;AAAA,EAmEtC,YAAY,MAAA,EAAwC;AAChD,IAAA,KAAA,CAAM,EAAE,IAAA,EAAM,WAAA,EAAa,CAAA;AAhE/B;AAAA;AAAA;AAAA,IAAA,IAAA,CAAiB,UAAA,GAAa,GAAA;AAI9B;AAAA;AAAA;AAAA,IAAA,IAAA,CAAiB,SAAA,GAAY,CAAA;AAI7B;AAAA;AAAA;AAAA,IAAA,IAAA,CAAiB,gBAAA,GAA6B;AAAA,MAC1C,UAAA;AAAA,MACA,cAAA;AAAA,MACA,WAAA;AAAA,MACA,oBAAA;AAAA,MACA,YAAA;AAAA,MACA,aAAA;AAAA,MACA,cAAA;AAAA,MACA,YAAA;AAAA,MACA,gBAAA;AAAA,MACA,YAAA;AAAA,MACA,aAAA;AAAA,MACA,eAAA;AAAA,MACA,eAAA;AAAA,MACA,iBAAA;AAAA,MACA,0BAAA;AAAA,MACA,kCAAA;AAAA,MACA,gBAAA;AAAA,MACA,iBAAA;AAAA,MACA,kBAAA;AAAA,MACA,oBAAA;AAAA,MACA,YAAA;AAAA,MACA,eAAA;AAAA,MACA;AAAA,KACJ;AAIA;AAAA;AAAA;AAAA,IAAA,IAAA,CAAiB,eAAA,uBAAsB,GAAA,CAAI;AAAA,MACvC,MAAA;AAAA,MAAQ,UAAA;AAAA,MAAY,OAAA;AAAA,MAAS,gBAAA;AAAA,MAC7B,UAAA;AAAA,MAAY,QAAA;AAAA,MAAU,YAAA;AAAA,MAAc,QAAA;AAAA,MAAU,SAAA;AAAA,MAC9C,YAAA;AAAA,MAAc,aAAA;AAAA,MAAe,cAAA;AAAA,MAAgB,eAAA;AAAA,MAC7C,cAAA;AAAA,MAAgB,gBAAA;AAAA,MAAkB,WAAA;AAAA,MAClC,WAAA;AAAA,MAAa,QAAA;AAAA,MAAU,MAAA;AAAA,MAAQ,MAAA;AAAA,MAC/B,SAAA;AAAA,MAAW,QAAA;AAAA,MAAU,SAAA;AAAA,MACrB,OAAA;AAAA,MAAS,SAAA;AAAA,MAAW;AAAA,KACvB,CAAA;AAID;AAAA;AAAA;AAAA,IAAA,IAAA,CAAiB,aAAA,GAAgB,2CAAA;AAKjC;AAAA;AAAA;AAAA;AAAA,IAAA,IAAA,CAAiB,WAAA,GAAc,2CAAA;AAa3B,IAAA,IAAA,CAAK,eAAA,GAAkB,QAAQ,cAAA,KAAmB,KAAA;AAClD,IAAA,IAAA,CAAK,WAAA,GAAc,QAAQ,UAAA,KAAe,KAAA;AAC1C,IAAA,IAAA,CAAK,SAAS,CAAC,GAAI,QAAQ,KAAA,IAAS,EAAG,CAAA,CAAE,IAAA;AAAA,MAAK,CAAC,CAAA,EAAG,CAAA,KAAA,CAC7C,EAAE,QAAA,IAAY,CAAA,KAAM,EAAE,QAAA,IAAY,CAAA;AAAA,KACvC;AAAA,EACJ;AAAA;AAAA;AAAA;AAAA,EAIA,IAAI,KAAA,GAAQ;AACR,IAAA,OAAO,IAAA,CAAK,MAAA;AAAA,EAChB;AAAA;AAAA;AAAA;AAAA,EAIA,IAAI,cAAA,GAAiB;AACjB,IAAA,OAAO,IAAA,CAAK,eAAA;AAAA,EAChB;AAAA;AAAA;AAAA;AAAA,EAIA,IAAI,UAAA,GAAa;AACb,IAAA,OAAO,IAAA,CAAK,WAAA;AAAA,EAChB;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAoBA,QAAQ,IAAA,EAA2C;AAC/C,IAAA,MAAM,OAAA,GAAU,KAAK,IAAA,EAAK;AAG1B,IAAA,IAAA,CAAK,SAAS,OAAO,CAAA;AAErB,IAAA,MAAM,UAAA,GAAa,IAAA,CAAK,oBAAA,CAAqB,OAAO,CAAA;AACpD,IAAA,MAAM,YAAA,GAAe,IAAA,CAAK,WAAA,CAAY,IAAA,CAAK,OAAO,CAAA;AAGlD,IAAA,IAAI,QAAA,GAA4B,IAAA;AAEhC,IAAA,IAAI,CAAC,YAAA,EAAc;AACf,MAAA,IAAI;AACA,QAAA,QAAA,GAAW,IAAI,QAAA,CAAS,OAAA,EAAS,CAAA,oCAAA,EAAuC,OAAO,CAAA,GAAA,CAAK,CAAA;AAAA,MACxF,SAAS,CAAA,EAAG;AACR,QAAA,MAAM,IAAI,KAAA,CAAM,CAAA,4BAAA,EAA+B,OAAO,CAAA,GAAA,EAAO,CAAA,CAAY,OAAO,CAAA,CAAE,CAAA;AAAA,MACtF;AAAA,IACJ;AAEA,IAAA,MAAM,eAAA,GAAkB,IAAA,CAAK,aAAA,CAAc,IAAA,CAAK,IAAI,CAAA;AAEpD,IAAA,OAAO;AAAA,MACH,UAAA;AAAA,MAEA,OAAA,CAAQ,OAAiB,KAAA,EAAkC;AAEvD,QAAA,IAAI,YAAA,EAAc;AACd,UAAA,IAAI,KAAA,IAAS,OAAA,IAAW,KAAA,EAAO,OAAO,MAAM,OAAO,CAAA;AACnD,UAAA,MAAM,KAAA,GAAQ,KAAA,CAAM,GAAA,CAAI,OAAO,CAAA;AAC/B,UAAA,IAAI,KAAA,KAAU,QAAW,OAAO,KAAA;AAAA,QAEpC;AAEA,QAAA,MAAM,OAAA,GAAU,eAAA,CAAgB,KAAA,EAAO,KAAK,CAAA;AAE5C,QAAA,IAAI,MAAA;AACJ,QAAA,IAAI;AACA,UAAA,MAAA,GAAS,QAAA,GACH,QAAA,CAAS,OAAO,CAAA,GAChB,IAAI,QAAA,CAAS,OAAA,EAAS,CAAA,oCAAA,EAAuC,OAAO,CAAA,GAAA,CAAK,CAAA,CAAE,OAAO,CAAA;AAAA,QAC5F,SAAS,CAAA,EAAG;AACR,UAAA,MAAM,IAAI,KAAA,CAAM,CAAA,gCAAA,EAAmC,OAAO,CAAA,GAAA,EAAO,CAAA,CAAY,OAAO,CAAA,CAAE,CAAA;AAAA,QAC1F;AAEA,QAAA,IAAI,UAAA,IAAc,OAAO,MAAA,KAAW,UAAA,EAAY;AAC5C,UAAA,MAAM,IAAI,KAAA;AAAA,YACN,eAAe,OAAO,CAAA,yCAAA,EAAuC,WAAW,IAAA,GAAO,MAAA,GAAS,OAAO,MAAM,CAAA;AAAA,WACzG;AAAA,QACJ;AAEA,QAAA,OAAO,MAAA;AAAA,MACX;AAAA,KACJ;AAAA,EACJ;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EA8BA,QAAA,CAAS,IAAA,EAAc,KAAA,EAAiB,KAAA,EAAkC;AACtE,IAAA,MAAM,OAAA,GAAU,KAAK,IAAA,EAAK;AAE1B,IAAA,IAAA,CAAK,SAAS,OAAO,CAAA;AAOrB,IAAA,IAAI,IAAA,CAAK,WAAA,CAAY,IAAA,CAAK,OAAO,CAAA,EAAG;AAChC,MAAA,IAAI,KAAA,IAAS,OAAA,IAAW,KAAA,EAAO,OAAO,MAAM,OAAO,CAAA;AAEnD,MAAA,MAAM,KAAA,GAAQ,KAAA,CAAM,GAAA,CAAI,OAAO,CAAA;AAC/B,MAAA,IAAI,KAAA,KAAU,QAAW,OAAO,KAAA;AAAA,IAMpC;AAEA,IAAA,MAAM,OAAA,GAAU,IAAA,CAAK,aAAA,CAAc,KAAA,EAAO,KAAK,CAAA;AAC/C,IAAA,MAAM,MAAA,GAAS,IAAA,CAAK,OAAA,CAAQ,OAAA,EAAS,OAAO,CAAA;AAE5C,IAAA,IAAI,IAAA,CAAK,oBAAA,CAAqB,OAAO,CAAA,EAAG;AACpC,MAAA,IAAI,OAAO,WAAW,UAAA,EAAY;AAC9B,QAAA,MAAM,IAAI,KAAA;AAAA,UACN,eAAe,OAAO,CAAA,yCAAA,EAAuC,WAAW,IAAA,GAAO,MAAA,GAAS,OAAO,MAAM,CAAA;AAAA,SACzG;AAAA,MACJ;AAAA,IACJ;AAEA,IAAA,OAAO,MAAA;AAAA,EACX;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAWA,oBAAoB,IAAA,EAA2B;AAC3C,IAAA,MAAM,WAAW,IAAA,CAAK,IAAA,EAAK,CAAE,OAAA,CAAQ,4BAA4B,IAAI,CAAA;AACrE,IAAA,MAAM,QAAA,uBAAe,GAAA,EAAY;AACjC,IAAA,MAAM,OAAA,GAAU,sBAAA;AAChB,IAAA,IAAI,KAAA;AAEJ,IAAA,OAAA,CAAQ,KAAA,GAAQ,OAAA,CAAQ,IAAA,CAAK,QAAQ,OAAO,IAAA,EAAM;AAC9C,MAAA,QAAA,CAAS,GAAA,CAAI,KAAA,CAAM,CAAC,CAAC,CAAA;AAAA,IACzB;AAEA,IAAA,OAAO,QAAA;AAAA,EACX;AAAA;AAAA,EAIQ,qBAAqB,IAAA,EAAuB;AAEhD,IAAA,IAAI,sBAAA,CAAuB,IAAA,CAAK,IAAI,CAAA,EAAG,OAAO,IAAA;AAG9C,IAAA,IAAI,gBAAA,CAAiB,IAAA,CAAK,IAAI,CAAA,EAAG,OAAO,IAAA;AAKxC,IAAA,OAAO,KAAA;AAAA,EACX;AAAA;AAAA,EAIQ,SAAS,IAAA,EAAoB;AACjC,IAAA,IAAI,IAAA,CAAK,MAAA,GAAS,IAAA,CAAK,UAAA,EAAY;AAC/B,MAAA,MAAM,IAAI,KAAA;AAAA,QACN,CAAA,qCAAA,EAAwC,KAAK,UAAU,CAAA,WAAA;AAAA,OAC3D;AAAA,IACJ;AAEA,IAAA,KAAA,MAAW,OAAA,IAAW,KAAK,gBAAA,EAAkB;AACzC,MAAA,IAAI,OAAA,CAAQ,IAAA,CAAK,IAAI,CAAA,EAAG;AACpB,QAAA,MAAM,IAAI,KAAA,CAAM,CAAA,qCAAA,EAAwC,OAAA,CAAQ,MAAM,CAAA,CAAE,CAAA;AAAA,MAC5E;AAAA,IACJ;AAEA,IAAA,IAAI,CAAC,IAAA,CAAK,aAAA,CAAc,IAAA,CAAK,IAAI,CAAA,EAAG;AAChC,MAAA,MAAM,IAAI,MAAM,CAAA,yCAAA,CAA2C,CAAA;AAAA,IAC/D;AAEA,IAAA,IAAA,CAAK,WAAW,IAAI,CAAA;AAAA,EACxB;AAAA,EAEQ,WAAW,IAAA,EAAoB;AACnC,IAAA,IAAI,KAAA,GAAQ,CAAA;AACZ,IAAA,IAAI,GAAA,GAAM,CAAA;AACV,IAAA,KAAA,MAAW,MAAM,IAAA,EAAM;AACnB,MAAA,IAAI,EAAA,KAAO,GAAA,IAAO,EAAA,KAAO,GAAA,IAAO,OAAO,GAAA,EAAK;AAAE,QAAA,KAAA,EAAA;AAAS,QAAA,GAAA,GAAM,IAAA,CAAK,GAAA,CAAI,GAAA,EAAK,KAAK,CAAA;AAAA,MAAE;AAClF,MAAA,IAAI,EAAA,KAAO,GAAA,IAAO,EAAA,KAAO,GAAA,IAAO,OAAO,GAAA,EAAK,KAAA,EAAA;AAAA,IAChD;AACA,IAAA,IAAI,GAAA,GAAM,KAAK,SAAA,EAAW;AACtB,MAAA,MAAM,IAAI,KAAA,CAAM,CAAA,4CAAA,EAA+C,IAAA,CAAK,SAAS,CAAA,CAAE,CAAA;AAAA,IACnF;AAAA,EACJ;AAAA;AAAA,EAIQ,aAAA,CAAc,OAAiB,KAAA,EAAqC;AACxE,IAAA,OAAO,IAAI,KAAA,CAAM,EAAC,EAAG;AAAA,MACjB,GAAA,EAAK,CAAC,CAAA,EAAG,GAAA,KAAQ;AACb,QAAA,IAAI,OAAO,QAAQ,QAAA,IAAY,IAAA,CAAK,gBAAgB,GAAA,CAAI,GAAG,GAAG,OAAO,KAAA;AACrE,QAAA,OAAO,IAAA;AAAA,MACX,CAAA;AAAA,MACA,GAAA,EAAK,CAAC,CAAA,EAAG,GAAA,KAAQ;AACb,QAAA,IAAI,OAAO,GAAA,KAAQ,QAAA,EAAU,OAAO,MAAA;AAGpC,QAAA,IAAI,KAAA,IAAS,GAAA,IAAO,KAAA,EAAO,OAAO,MAAM,GAAG,CAAA;AAE3C,QAAA,IAAA,CAAK,cAAc,GAAG,CAAA;AAEtB,QAAA,MAAM,KAAA,GAAQ,KAAA,CAAM,GAAA,CAAI,GAAG,CAAA;AAC3B,QAAA,IAAI,OAAO,KAAA,KAAU,UAAA,EAAY,OAAO,KAAA,CAAM,KAAK,KAAK,CAAA;AACxD,QAAA,IAAI,UAAU,IAAA,IAAQ,OAAO,KAAA,KAAU,QAAA,IAAY,UAAU,MAAA,EAAW;AACpE,UAAA,OAAO,IAAI,KAAA,CAAM,KAAA,EAAiB,KAAK,aAAA,CAAc,GAAA,EAAK,KAAK,CAAC,CAAA;AAAA,QACpE;AACA,QAAA,OAAO,KAAA;AAAA,MACX,CAAA;AAAA,MACA,KAAK,MAAM;AAAE,QAAA,MAAM,IAAI,MAAM,+BAA+B,CAAA;AAAA,MAAE;AAAA,KACjE,CAAA;AAAA,EACL;AAAA,EAEQ,aAAA,CAAc,QAAgB,KAAA,EAAuC;AACzE,IAAA,OAAO;AAAA,MACH,KAAK,MAAM,IAAA;AAAA,MACX,GAAA,EAAK,CAAC,MAAA,EAAQ,GAAA,KAAQ;AAClB,QAAA,IAAI,OAAO,GAAA,KAAQ,QAAA,EAAU,OAAO,MAAA;AACpC,QAAA,IAAA,CAAK,cAAc,GAAG,CAAA;AAEtB,QAAA,MAAM,OAAA,GAAU,CAAA,EAAG,MAAM,CAAA,CAAA,EAAI,GAAG,CAAA,CAAA;AAChC,QAAA,MAAM,KAAA,GAAQ,KAAA,CAAM,GAAA,CAAI,OAAO,CAAA;AAE/B,QAAA,IAAI,KAAA,KAAU,MAAA,EAAW,OAAQ,MAAA,CAAe,GAAG,CAAA;AACnD,QAAA,IAAI,OAAO,KAAA,KAAU,UAAA,EAAY,OAAO,KAAA,CAAM,KAAK,KAAK,CAAA;AACxD,QAAA,IAAI,KAAA,KAAU,IAAA,IAAQ,OAAO,KAAA,KAAU,QAAA,EAAU;AAC7C,UAAA,OAAO,IAAI,KAAA,CAAM,KAAA,EAAiB,KAAK,aAAA,CAAc,OAAA,EAAS,KAAK,CAAC,CAAA;AAAA,QACxE;AACA,QAAA,OAAO,KAAA;AAAA,MACX,CAAA;AAAA,MACA,KAAK,MAAM;AAAE,QAAA,MAAM,IAAI,MAAM,+BAA+B,CAAA;AAAA,MAAE;AAAA,KAClE;AAAA,EACJ;AAAA,EAEQ,cAAc,GAAA,EAAmB;AACrC,IAAA,IAAI,GAAA,KAAQ,WAAA,IAAe,GAAA,KAAQ,aAAA,IAAiB,QAAQ,WAAA,EAAa;AACrE,MAAA,MAAM,IAAI,KAAA,CAAM,CAAA,WAAA,EAAc,GAAG,CAAA,+BAAA,CAAiC,CAAA;AAAA,IACtE;AACA,IAAA,IAAI,IAAA,CAAK,eAAA,CAAgB,GAAA,CAAI,GAAG,CAAA,EAAG;AAC/B,MAAA,MAAM,IAAI,KAAA,CAAM,CAAA,WAAA,EAAc,GAAG,CAAA,+BAAA,CAAiC,CAAA;AAAA,IACtE;AAAA,EACJ;AAAA;AAAA,EAIQ,OAAA,CAAQ,MAAc,OAAA,EAAsB;AAChD,IAAA,IAAI,EAAA;AACJ,IAAA,IAAI;AACA,MAAA,EAAA,GAAK,IAAI,QAAA,CAAS,OAAA,EAAS,CAAA,sBAAA,EAAyB,IAAI,CAAA,GAAA,CAAK,CAAA;AAAA,IACjE,SAAS,CAAA,EAAG;AACR,MAAA,MAAM,IAAI,KAAA,CAAM,CAAA,4BAAA,EAA+B,IAAI,CAAA,GAAA,EAAO,CAAA,CAAY,OAAO,CAAA,CAAE,CAAA;AAAA,IACnF;AAEA,IAAA,IAAI;AACA,MAAA,OAAO,GAAG,OAAO,CAAA;AAAA,IACrB,SAAS,CAAA,EAAG;AACR,MAAA,MAAM,IAAI,KAAA,CAAM,CAAA,gCAAA,EAAmC,IAAI,CAAA,GAAA,EAAO,CAAA,CAAY,OAAO,CAAA,CAAE,CAAA;AAAA,IACvF;AAAA,EACJ;AACJ;AAzXaD,iBAAA,GAAN,eAAA,CAAA;AAAA,EALNE,eAAQ,QAAA,CAAS;AAAA,IACd,SAAA,EAAW,OAAA;AAAA,IACX,IAAA,EAAM,kBAAA;AAAA,IACN,WAAA,EAAa;AAAA,GAChB;AAAA,CAAA,EACYF,iBAAA,CAAA","file":"AreSyntax.context.js","sourcesContent":["import { A_Fragment } from \"@adaas/a-concept\";\nimport { A_Frame } from \"@adaas/a-frame\";\nimport { AreSyntaxCompiledExpression, AreSyntaxInitOptions, AreSyntaxTokenRules } from \"./AreSyntax.types\";\nimport { AreStore } from \"@adaas/are/store/AreStore.context\";\n\n@A_Frame.Fragment({\n    namespace: 'A-ARE',\n    name: 'AreSyntaxContext',\n    description: 'Context that defines the syntax rules and structures for the A-Concept Rendering Engine (ARE). It provides mechanisms for parsing and interpreting templates, attributes, directives, interpolations, and event listeners, enabling dynamic and interactive UI rendering within the ARE framework.'\n})\nexport class AreSyntax extends A_Fragment {\n    /**\n     * Max allowed length of an expression string to prevent excessively long inputs that could lead to performance issues or abuse.\n     */\n    private readonly MAX_LENGTH = 500\n    /**\n     * Max allowed nesting depth of parentheses, brackets, and braces in expressions to prevent excessively complex inputs that could lead to performance issues or abuse. Default is 5 levels of nesting.\n     */\n    private readonly MAX_DEPTH = 5\n    /**\n     * List of regex patterns that are blocked in expressions to prevent access to unsafe or sensitive features. This includes patterns for global objects, functions, and syntax that could be used for malicious purposes (e.g. \"eval\", \"Function\", \"fetch\", \"XMLHttpRequest\", \"import\", \"require\", \"document\", \"window\", \"globalThis\", \"global\", \"process\", \"__proto__\", \"constructor\", \"prototype\"). Expressions containing any of these patterns will be rejected during validation.\n     */\n    private readonly BLOCKED_PATTERNS: RegExp[] = [\n        /\\beval\\b/,\n        /\\bFunction\\b/,\n        /\\bfetch\\b/,\n        /\\bXMLHttpRequest\\b/,\n        /\\bimport\\b/,\n        /\\brequire\\b/,\n        /\\bdocument\\b/,\n        /\\bwindow\\b/,\n        /\\bglobalThis\\b/,\n        /\\bglobal\\b/,\n        /\\bprocess\\b/,\n        /\\b__proto__\\b/,\n        /\\bprototype\\b/,\n        /\\bconstructor\\b/,\n        /\\bObject\\s*\\.\\s*assign\\b/,\n        /\\bObject\\s*\\.\\s*defineProperty\\b/,\n        /\\bsetTimeout\\b/,\n        /\\bsetInterval\\b/,\n        /\\blocalStorage\\b/,\n        /\\bsessionStorage\\b/,\n        /\\bcookie\\b/,\n        /\\bWebSocket\\b/,\n        /\\bWorker\\b/,\n    ]\n    /**\n     * Set of global identifiers that are blocked in expressions to prevent access to unsafe or sensitive features. This includes global objects and functions that could be used for malicious purposes (e.g. \"eval\", \"Function\", \"fetch\", \"XMLHttpRequest\", \"document\", \"window\", \"globalThis\", \"global\", \"process\", \"setTimeout\", \"setInterval\", \"localStorage\", \"sessionStorage\", \"indexedDB\", \"WebSocket\", \"Worker\"). Accessing any of these identifiers in an expression will be rejected during validation.\n     */\n    private readonly BLOCKED_GLOBALS = new Set([\n        'eval', 'Function', 'fetch', 'XMLHttpRequest',\n        'document', 'window', 'globalThis', 'global', 'process',\n        'setTimeout', 'setInterval', 'clearTimeout', 'clearInterval',\n        'localStorage', 'sessionStorage', 'indexedDB',\n        'WebSocket', 'Worker', 'Blob', 'File',\n        'require', 'module', 'exports',\n        'alert', 'confirm', 'prompt',\n    ])\n    /**\n     * Regex pattern that defines the allowed characters in expressions. This pattern allows letters, digits, whitespace, and common operators and punctuation used in JavaScript expressions. Expressions containing characters that do not match this pattern will be rejected during validation to prevent injection of potentially harmful code.\n     */\n    private readonly ALLOWED_CHARS = /^[\\w\\s\\d\\.\\[\\]()=><|&!+\\-*/%?:,'\"`;~^$]+$/\n    /**\n     * Simple dot-path identifier pattern (e.g. \"name\", \"user.name\", \"user.profile.name\").\n     * Matches strings that consist solely of identifier characters separated by dots.\n     */\n    private readonly SIMPLE_PATH = /^[a-zA-Z_$][\\w$]*(?:\\.[a-zA-Z_$][\\w$]*)*$/\n    /**\n     * Compiled expression — a pre-parsed function ready for repeated execution.\n     * Created once via compile(), reused on every apply/click.\n     */\n\n    private readonly _rules: AreSyntaxTokenRules[]\n    private readonly _trimWhitespace: boolean\n    private readonly _strictMode: boolean\n\n    constructor(config?: Partial<AreSyntaxInitOptions>) {\n        super({ name: 'AreSyntax' })\n\n        this._trimWhitespace = config?.trimWhitespace !== false\n        this._strictMode = config?.strictMode !== false\n        this._rules = [...(config?.rules ?? [])].sort((a, b) =>\n            (b.priority ?? 0) - (a.priority ?? 0)\n        )\n    }\n    /**\n     * Get the array of token rules that define the syntax for parsing templates. Each rule specifies how to identify and process a particular type of token (e.g. interpolation, directive, comment) within templates. The rules are checked in order of priority, allowing for flexible and customizable parsing behavior.\n     */\n    get rules() {\n        return this._rules\n    }\n    /**\n     * Indicates whether leading and trailing whitespace should be trimmed from token content. When enabled, any whitespace at the start or end of the content captured by a token will be removed before further processing. This can help prevent issues with unintended spaces affecting rendering or logic, especially in cases like interpolations or directives where extra whitespace may be common. Default is true.\n     */\n    get trimWhitespace() {\n        return this._trimWhitespace\n    }\n    /**\n     * Indicates whether the parser should throw an error when it encounters unclosed tokens. When enabled, if the parser finds an opening delimiter without a corresponding closing delimiter (e.g. an unclosed interpolation or directive), it will throw an error instead of silently ignoring it. This can help catch syntax errors and ensure that templates are well-formed. Default is true.\n     */\n    get strictMode() {\n        return this._strictMode\n    }\n\n\n\n    /**\n     * Compiles an expression string into a reusable executor.\n     * Performs validation and Function construction once.\n     * Use when the same expression will be evaluated multiple times\n     * e.g. event handlers, instructions that re-apply on store changes.\n     *\n     * @example\n     *   // compile once at apply() time\n     *   const compiled = AreCommonHelper.compile('(e) => !!pageTitle ? $testHandler(e, item) : null')\n     *\n     *   // execute on every click — no re-parsing, no re-validation\n     *   element.addEventListener('click', (e) => {\n     *       const fn = compiled.execute(store, { $testHandler: handler, item })\n     *       if (typeof fn === 'function') fn(e)\n     *   })\n     */\n    compile(expr: string): AreSyntaxCompiledExpression {\n        const trimmed = expr.trim()\n\n        // validate once — throws if expression is unsafe or malformed\n        this.validate(trimmed)\n\n        const isCallable = this.isCallableExpression(trimmed)\n        const isSimplePath = this.SIMPLE_PATH.test(trimmed)\n\n        // pre-build the Function once — most expensive part\n        let compiled: Function | null = null\n\n        if (!isSimplePath) {\n            try {\n                compiled = new Function('scope', `\"use strict\"; with(scope) { return (${trimmed}) }`)\n            } catch (e) {\n                throw new Error(`Expression syntax error in \"${trimmed}\": ${(e as Error).message}`)\n            }\n        }\n\n        const createSandboxFn = this.createSandbox.bind(this)\n\n        return {\n            isCallable,\n\n            execute(store: AreStore, scope?: Record<string, any>): any {\n                // fast path — simple property path, no sandbox needed\n                if (isSimplePath) {\n                    if (scope && trimmed in scope) return scope[trimmed]\n                    const value = store.get(trimmed)\n                    if (value !== undefined) return value\n                    // fall through to sandbox if store didn't resolve it\n                }\n\n                const sandbox = createSandboxFn(store, scope)\n\n                let result: any\n                try {\n                    result = compiled\n                        ? compiled(sandbox)\n                        : new Function('scope', `\"use strict\"; with(scope) { return (${trimmed}) }`)(sandbox)\n                } catch (e) {\n                    throw new Error(`Expression evaluation error in \"${trimmed}\": ${(e as Error).message}`)\n                }\n\n                if (isCallable && typeof result !== 'function') {\n                    throw new Error(\n                        `Expression \"${trimmed}\" was expected to be callable — got ${result === null ? 'null' : typeof result}`\n                    )\n                }\n\n                return result\n            }\n        }\n    }\n    /**\n     * Evaluates an expression string against the provided store.\n     * Automatically determines whether the result should be callable\n     * based on the shape of the expression.\n     *\n     * Returns the raw value for plain expressions (interpolations, bindings).\n     * Returns a bound function for callable expressions (event handlers).\n     *\n     * @param expr  Expression string to evaluate.\n     * @param store AreStore used for identifier resolution.\n     * @param scope Optional extra bindings checked **before** the store.\n     *              Useful for injecting event-specific values (`$event`, `element`)\n     *              or emit wrappers (`$handleClick`).\n     *\n     * @example\n     *   // simple value\n     *   evaluate('user.name', store)\n     *\n     *   // with emit wrapper\n     *   evaluate('$handleClick($event, user.name)', store, {\n     *       $event: domEvent,\n     *       $handleClick: (...args) => node.emit(new AreEvent('handleClick', args)),\n     *   })\n     *\n     *   // arrow with conditional\n     *   evaluate('(e) => isValid(user.name) ? $handleClick(e) : null', store, {\n     *       $handleClick: (...args) => node.emit(new AreEvent('handleClick', args)),\n     *   })\n     */\n    evaluate(expr: string, store: AreStore, scope?: Record<string, any>): any {\n        const trimmed = expr.trim()\n\n        this.validate(trimmed)\n\n        /**\n         * Fast path: if the expression is a simple property path (e.g. \"name\", \"user.name\"),\n         * resolve it directly — first from scope, then from the store — without going\n         * through the sandbox/Function constructor.\n         */\n        if (this.SIMPLE_PATH.test(trimmed)) {\n            if (scope && trimmed in scope) return scope[trimmed]\n\n            const value = store.get(trimmed)\n            if (value !== undefined) return value\n\n            /**\n             * If the full dot-path didn't resolve, fall back to the sandbox approach\n             * in case the store holds a nested object under the first key.\n             */\n        }\n\n        const sandbox = this.createSandbox(store, scope)\n        const result = this.execute(trimmed, sandbox)\n\n        if (this.isCallableExpression(trimmed)) {\n            if (typeof result !== 'function') {\n                throw new Error(\n                    `Expression \"${trimmed}\" was expected to be callable — got ${result === null ? 'null' : typeof result}`\n                )\n            }\n        }\n\n        return result\n    }\n\n    /**\n     * Extracts $-prefixed handler names from an expression.\n     * These represent event emission targets, not store references.\n     *\n     * Examples:\n     *   \"$handleClick\"                                     → Set([\"handleClick\"])\n     *   \"$handleClick(user.name)\"                           → Set([\"handleClick\"])\n     *   \"(e) => isValid(user.name) ? $handleClick(e) : null\" → Set([\"handleClick\"])\n     */\n    extractEmitHandlers(expr: string): Set<string> {\n        const stripped = expr.trim().replace(/'[^']*'|\"[^\"]*\"|`[^`]*`/g, '\"\"')\n        const handlers = new Set<string>()\n        const pattern = /\\$([a-zA-Z_][\\w$]*)/g\n        let match: RegExpExecArray | null\n\n        while ((match = pattern.exec(stripped)) !== null) {\n            handlers.add(match[1])\n        }\n\n        return handlers\n    }\n\n    // ── Classification ────────────────────────────────────────────────────────\n\n    private isCallableExpression(expr: string): boolean {\n        // arrow function:  () => ...  or  x => ...\n        if (/^\\(?[\\w\\s,]*\\)?\\s*=>/.test(expr)) return true\n\n        // function keyword:  function(...) { }\n        if (/^function\\s*\\(/.test(expr)) return true\n\n        // plain identifier with no operators — could be a function ref\n        // but only if it resolves to a function — we let the guard handle it\n        // so we don't classify this as callable upfront\n        return false\n    }\n\n    // ── Validation ────────────────────────────────────────────────────────────\n\n    private validate(expr: string): void {\n        if (expr.length > this.MAX_LENGTH) {\n            throw new Error(\n                `Expression exceeds maximum length of ${this.MAX_LENGTH} characters`\n            )\n        }\n\n        for (const pattern of this.BLOCKED_PATTERNS) {\n            if (pattern.test(expr)) {\n                throw new Error(`Expression contains blocked pattern: ${pattern.source}`)\n            }\n        }\n\n        if (!this.ALLOWED_CHARS.test(expr)) {\n            throw new Error(`Expression contains disallowed characters`)\n        }\n\n        this.checkDepth(expr)\n    }\n\n    private checkDepth(expr: string): void {\n        let depth = 0\n        let max = 0\n        for (const ch of expr) {\n            if (ch === '(' || ch === '[' || ch === '{') { depth++; max = Math.max(max, depth) }\n            if (ch === ')' || ch === ']' || ch === '}') depth--\n        }\n        if (max > this.MAX_DEPTH) {\n            throw new Error(`Expression exceeds maximum nesting depth of ${this.MAX_DEPTH}`)\n        }\n    }\n\n    // ── Sandbox ───────────────────────────────────────────────────────────────\n\n    private createSandbox(store: AreStore, scope?: Record<string, any>): object {\n        return new Proxy({}, {\n            has: (_, key) => {\n                if (typeof key === 'string' && this.BLOCKED_GLOBALS.has(key)) return false\n                return true\n            },\n            get: (_, key) => {\n                if (typeof key !== 'string') return undefined\n\n                // Scope bindings take priority over the store\n                if (scope && key in scope) return scope[key]\n\n                this.assertSafeKey(key)\n\n                const value = store.get(key)\n                if (typeof value === 'function') return value.bind(store)\n                if (value !== null && typeof value === 'object' && value !== undefined) {\n                    return new Proxy(value as object, this.nestedHandler(key, store))\n                }\n                return value\n            },\n            set: () => { throw new Error('Expression scope is read-only') },\n        })\n    }\n\n    private nestedHandler(prefix: string, store: AreStore): ProxyHandler<object> {\n        return {\n            has: () => true,\n            get: (target, key) => {\n                if (typeof key !== 'string') return undefined\n                this.assertSafeKey(key)\n\n                const fullKey = `${prefix}.${key}`\n                const value = store.get(fullKey)\n\n                if (value === undefined) return (target as any)[key]\n                if (typeof value === 'function') return value.bind(store)\n                if (value !== null && typeof value === 'object') {\n                    return new Proxy(value as object, this.nestedHandler(fullKey, store))\n                }\n                return value\n            },\n            set: () => { throw new Error('Expression scope is read-only') },\n        }\n    }\n\n    private assertSafeKey(key: string): void {\n        if (key === '__proto__' || key === 'constructor' || key === 'prototype') {\n            throw new Error(`Access to \"${key}\" is not allowed in expressions`)\n        }\n        if (this.BLOCKED_GLOBALS.has(key)) {\n            throw new Error(`Access to \"${key}\" is not allowed in expressions`)\n        }\n    }\n\n    // ── Execution ─────────────────────────────────────────────────────────────\n\n    private execute(expr: string, sandbox: object): any {\n        let fn: Function\n        try {\n            fn = new Function('scope', `with(scope) { return (${expr}) }`)\n        } catch (e) {\n            throw new Error(`Expression syntax error in \"${expr}\": ${(e as Error).message}`)\n        }\n\n        try {\n            return fn(sandbox)\n        } catch (e) {\n            throw new Error(`Expression evaluation error in \"${expr}\": ${(e as Error).message}`)\n        }\n    }\n}"]}