@erickxavier/no-js 1.8.2 → 1.9.1

package/src/evaluate.js

@@ -2,89 +2,1018 @@
 //  EXPRESSION EVALUATOR
 // ═══════════════════════════════════════════════════════════════════════
 
-import { _stores, _routerInstance, _filters, _warn, _config, _notifyStoreWatchers } from "./globals.js";
+import { _stores, _routerInstance, _filters, _warn, _notifyStoreWatchers } from "./globals.js";
 import { _i18n } from "./i18n.js";
 import { _collectKeys } from "./context.js";
 
 const _exprCache = new Map();
+const _stmtCache = new Map();
 
-// CSP-safe expression evaluator (no new Function / eval)
-// Handles dot-notation paths, basic comparisons, boolean operators, negation, and literals.
-function _cspSafeEval(expr, keys, vals) {
-  const scope = {};
-  for (let i = 0; i < keys.length; i++) scope[keys[i]] = vals[i];
+// ── Tokenizer ──────────────────────────────────────────────────────────
 
-  function resolvePath(path, obj) {
-    return path.split(".").reduce((o, k) => o?.[k], obj);
+const _KEYWORDS = new Set(["true", "false", "null", "undefined", "typeof", "in", "instanceof"]);
+const _FORBIDDEN = new Set(["__proto__", "constructor", "prototype"]);
+
+// Multi-char operators/punctuation, sorted longest-first for greedy matching
+const _MULTI = ["===", "!==", "...", "??", "?.", "==", "!=", ">=", "<=", "&&", "||", "+=", "-=", "*=", "/=", "%=", "++", "--", "=>"];
+const _SINGLE_OPS = new Set(["+", "-", "*", "/", "%", ">", "<", "!", "=", "|"]);
+const _SINGLE_PUNC = new Set(["(", ")", "[", "]", "{", "}", ".", ",", ":", ";", "?"]);
+
+function _tokenize(expr) {
+  if (typeof expr !== "string") return [];
+  const tokens = [];
+  const len = expr.length;
+  let pos = 0;
+
+  while (pos < len) {
+    const ch = expr[pos];
+
+    // Skip whitespace
+    if (ch === " " || ch === "\t" || ch === "\n" || ch === "\r") { pos++; continue; }
+
+    // String literals (single or double quoted)
+    if (ch === "'" || ch === '"') {
+      const start = pos;
+      const quote = ch;
+      pos++;
+      let value = "";
+      while (pos < len && expr[pos] !== quote) {
+        if (expr[pos] === "\\") {
+          pos++;
+          if (pos < len) {
+            const esc = expr[pos];
+            if (esc === "n") value += "\n";
+            else if (esc === "t") value += "\t";
+            else if (esc === "r") value += "\r";
+            else value += esc;
+            pos++;
+          }
+        } else {
+          value += expr[pos++];
+        }
+      }
+      if (pos < len) pos++; // skip closing quote
+      tokens.push({ type: "String", value, pos: start });
+      continue;
+    }
+
+    // Template literals
+    if (ch === "`") {
+      const start = pos;
+      pos++;
+      const parts = [];
+      const exprs = [];
+      let seg = "";
+      while (pos < len && expr[pos] !== "`") {
+        if (expr[pos] === "\\" && pos + 1 < len) {
+          const esc = expr[pos + 1];
+          if (esc === "n") seg += "\n";
+          else if (esc === "t") seg += "\t";
+          else if (esc === "r") seg += "\r";
+          else seg += esc;
+          pos += 2;
+        } else if (expr[pos] === "$" && pos + 1 < len && expr[pos + 1] === "{") {
+          parts.push(seg);
+          seg = "";
+          pos += 2; // skip ${
+          // Collect expression text respecting nested braces
+          let depth = 1;
+          let inner = "";
+          while (pos < len && depth > 0) {
+            if (expr[pos] === "{") depth++;
+            else if (expr[pos] === "}") { depth--; if (depth === 0) break; }
+            else if (expr[pos] === "'" || expr[pos] === '"' || expr[pos] === "`") {
+              // skip string inside interpolation
+              const q = expr[pos];
+              inner += q; pos++;
+              while (pos < len && expr[pos] !== q) {
+                if (expr[pos] === "\\") { inner += expr[pos++]; if (pos < len) inner += expr[pos++]; }
+                else inner += expr[pos++];
+              }
+              if (pos < len) { inner += expr[pos]; pos++; }
+              continue;
+            }
+            inner += expr[pos++];
+          }
+          if (pos < len) pos++; // skip closing }
+          exprs.push(_tokenize(inner));
+        } else {
+          seg += expr[pos++];
+        }
+      }
+      if (pos < len) pos++; // skip closing `
+      parts.push(seg);
+      tokens.push({ type: "Template", parts, exprs, pos: start });
+      continue;
+    }
+
+    // Numbers: starts with digit, or '.' followed by digit
+    if ((ch >= "0" && ch <= "9") || (ch === "." && pos + 1 < len && expr[pos + 1] >= "0" && expr[pos + 1] <= "9")) {
+      const start = pos;
+      let num = "";
+      while (pos < len && ((expr[pos] >= "0" && expr[pos] <= "9") || expr[pos] === ".")) {
+        num += expr[pos++];
+      }
+      tokens.push({ type: "Number", value: num, pos: start });
+      continue;
+    }
+
+    // Identifiers / Keywords
+    if ((ch >= "a" && ch <= "z") || (ch >= "A" && ch <= "Z") || ch === "_" || ch === "$") {
+      const start = pos;
+      let id = "";
+      while (pos < len) {
+        const c = expr[pos];
+        if ((c >= "a" && c <= "z") || (c >= "A" && c <= "Z") || (c >= "0" && c <= "9") || c === "_" || c === "$") {
+          id += c; pos++;
+        } else break;
+      }
+      if (_FORBIDDEN.has(id)) tokens.push({ type: "Forbidden", value: id, pos: start });
+      else if (_KEYWORDS.has(id)) tokens.push({ type: "Keyword", value: id, pos: start });
+      else tokens.push({ type: "Ident", value: id, pos: start });
+      continue;
+    }
+
+    // Multi-char operators / punctuation (longest first)
+    let matched = false;
+    for (let m = 0; m < _MULTI.length; m++) {
+      const op = _MULTI[m];
+      if (expr.startsWith(op, pos)) {
+        const isPunc = op === "..." || op === "?.";
+        tokens.push({ type: isPunc ? "Punc" : "Op", value: op, pos });
+        pos += op.length;
+        matched = true;
+        break;
+      }
+    }
+    if (matched) continue;
+
+    // Single-char operators
+    if (_SINGLE_OPS.has(ch)) {
+      tokens.push({ type: "Op", value: ch, pos });
+      pos++;
+      continue;
+    }
+
+    // Single-char punctuation
+    if (_SINGLE_PUNC.has(ch)) {
+      tokens.push({ type: "Punc", value: ch, pos });
+      pos++;
+      continue;
+    }
+
+    // Unrecognized character — skip
+    pos++;
+  }
+
+  return tokens;
+}
+
+// ── Recursive-descent expression parser ────────────────────────────────
+
+function _parseExpr(tokens) {
+  if (!tokens || tokens.length === 0) return { type: "Literal", value: undefined };
+
+  let pos = 0;
+
+  function peek() { return tokens[pos]; }
+  function next() { return tokens[pos++]; }
+
+  function match(type, value) {
+    const t = tokens[pos];
+    if (!t) return false;
+    if (value !== undefined) return t.type === type && t.value === value;
+    return t.type === type;
+  }
+
+  function expect(type, value) {
+    const t = tokens[pos];
+    if (t && t.type === type && (value === undefined || t.value === value)) {
+      pos++;
+      return t;
+    }
+    return null;
+  }
+
+  // ─── Grammar rules (lowest → highest precedence) ───
+
+  function parseExpression() {
+    return parseTernary();
+  }
+
+  function parseTernary() {
+    let node = parseNullishOr();
+    if (match("Punc", "?")) {
+      next(); // consume ?
+      const consequent = parseTernary();
+      expect("Punc", ":");
+      const alternate = parseTernary();
+      node = { type: "ConditionalExpr", test: node, consequent, alternate };
+    }
+    return node;
+  }
+
+  function parseNullishOr() {
+    let node = parseLogicalOr();
+    if (match("Op", "??")) {
+      next();
+      const right = parseNullishOr();
+      node = { type: "BinaryExpr", op: "??", left: node, right };
+    }
+    return node;
+  }
+
+  function parseLogicalOr() {
+    let node = parseLogicalAnd();
+    while (match("Op", "||")) {
+      next();
+      const right = parseLogicalAnd();
+      node = { type: "BinaryExpr", op: "||", left: node, right };
+    }
+    return node;
+  }
+
+  function parseLogicalAnd() {
+    let node = parseBitwiseOr();
+    while (match("Op", "&&")) {
+      next();
+      const right = parseBitwiseOr();
+      node = { type: "BinaryExpr", op: "&&", left: node, right };
+    }
+    return node;
+  }
+
+  function parseBitwiseOr() {
+    let node = parseComparison();
+    while (peek() && peek().type === "Op" && peek().value === "|" && (!tokens[pos + 1] || tokens[pos + 1].value !== "|")) {
+      next();
+      const right = parseComparison();
+      node = { type: "BinaryExpr", op: "|", left: node, right };
+    }
+    return node;
+  }
+
+  function parseComparison() {
+    let node = parseAddition();
+    const t = peek();
+    if (!t) return node;
+    const compOps = ["===", "!==", "==", "!=", ">=", "<=", ">", "<"];
+    if ((t.type === "Op" && compOps.indexOf(t.value) !== -1) ||
+        (t.type === "Keyword" && (t.value === "in" || t.value === "instanceof"))) {
+      const op = next().value;
+      const right = parseAddition();
+      node = { type: "BinaryExpr", op, left: node, right };
+    }
+    return node;
+  }
+
+  function parseAddition() {
+    let node = parseMultiplication();
+    while (peek() && peek().type === "Op" && (peek().value === "+" || peek().value === "-")) {
+      const op = next().value;
+      const right = parseMultiplication();
+      node = { type: "BinaryExpr", op, left: node, right };
+    }
+    return node;
+  }
+
+  function parseMultiplication() {
+    let node = parseUnary();
+    while (peek() && peek().type === "Op" && (peek().value === "*" || peek().value === "/" || peek().value === "%")) {
+      const op = next().value;
+      const right = parseUnary();
+      node = { type: "BinaryExpr", op, left: node, right };
+    }
+    return node;
+  }
+
+  function parseUnary() {
+    const t = peek();
+    if (!t) return { type: "Literal", value: undefined };
+    // typeof
+    if (t.type === "Keyword" && t.value === "typeof") {
+      next();
+      return { type: "UnaryExpr", op: "typeof", argument: parseUnary() };
+    }
+    // ! or unary - or unary +
+    if (t.type === "Op" && (t.value === "!" || t.value === "-" || t.value === "+")) {
+      next();
+      return { type: "UnaryExpr", op: t.value, argument: parseUnary() };
+    }
+    // Prefix ++ / --
+    if (t.type === "Op" && (t.value === "++" || t.value === "--")) {
+      next();
+      return { type: "UnaryExpr", op: t.value, argument: parseUnary(), prefix: true };
+    }
+    return parsePostfix();
+  }
+
+  function parsePostfix() {
+    let node = parseCallMember();
+    const t = peek();
+    if (t && t.type === "Op" && (t.value === "++" || t.value === "--")) {
+      next();
+      node = { type: "PostfixExpr", op: t.value, argument: node };
+    }
+    return node;
+  }
+
+  function parseCallMember() {
+    let node = parsePrimary();
+
+    while (true) {
+      const t = peek();
+      if (!t) break;
+
+      // Dot access: obj.prop
+      if (t.type === "Punc" && t.value === ".") {
+        next();
+        const prop = peek();
+        if (prop && (prop.type === "Ident" || prop.type === "Keyword")) {
+          next();
+          node = { type: "MemberExpr", object: node, property: { type: "Identifier", name: prop.value }, computed: false };
+        } else if (prop && prop.type === "Forbidden") {
+          next();
+          node = { type: "Forbidden" };
+        } else {
+          break;
+        }
+        continue;
+      }
+
+      // Optional chaining: obj?.prop or obj?.(args)
+      if (t.type === "Punc" && t.value === "?.") {
+        next();
+        const nt = peek();
+        // Optional call: obj?.(args)
+        if (nt && nt.type === "Punc" && nt.value === "(") {
+          next(); // consume (
+          const args = parseArgsList();
+          expect("Punc", ")");
+          node = { type: "OptionalCallExpr", callee: node, args };
+        }
+        // Optional member: obj?.prop
+        else if (nt && (nt.type === "Ident" || nt.type === "Keyword")) {
+          next();
+          node = { type: "OptionalMemberExpr", object: node, property: { type: "Identifier", name: nt.value }, computed: false };
+        }
+        // Optional bracket: obj?.[expr]
+        else if (nt && nt.type === "Punc" && nt.value === "[") {
+          next(); // consume [
+          const prop = parseExpression();
+          expect("Punc", "]");
+          node = { type: "OptionalMemberExpr", object: node, property: prop, computed: true };
+        } else {
+          break;
+        }
+        continue;
+      }
+
+      // Bracket access: obj[expr]
+      if (t.type === "Punc" && t.value === "[") {
+        next();
+        const prop = parseExpression();
+        expect("Punc", "]");
+        node = { type: "MemberExpr", object: node, property: prop, computed: true };
+        continue;
+      }
+
+      // Function call: fn(args)
+      if (t.type === "Punc" && t.value === "(") {
+        next();
+        const args = parseArgsList();
+        expect("Punc", ")");
+        node = { type: "CallExpr", callee: node, args };
+        continue;
+      }
+
+      break;
+    }
+
+    return node;
+  }
+
+  function parseArgsList() {
+    const args = [];
+    if (match("Punc", ")")) return args;
+    args.push(parseSpreadOrExpr());
+    while (match("Punc", ",")) {
+      next();
+      if (match("Punc", ")")) break; // trailing comma
+      args.push(parseSpreadOrExpr());
+    }
+    return args;
+  }
+
+  function parseSpreadOrExpr() {
+    if (match("Punc", "...")) {
+      next();
+      return { type: "SpreadElement", argument: parseExpression() };
+    }
+    return parseExpression();
+  }
+
+  // ─── Arrow function detection helpers ───
+
+  function isArrowParams() {
+    // Lookahead from current pos (after consuming "(") to see if this is (id, id, ...) =>
+    const saved = pos;
+    // Empty params: () =>
+    if (match("Punc", ")")) {
+      const after = tokens[pos + 1];
+      if (after && after.type === "Op" && after.value === "=>") {
+        pos = saved;
+        return true;
+      }
+      pos = saved;
+      return false;
+    }
+    // Check for ident list followed by ) =>
+    while (pos < tokens.length) {
+      const t = peek();
+      if (!t) break;
+      if (t.type === "Ident") {
+        next();
+        if (match("Punc", ",")) {
+          next();
+          continue;
+        }
+        if (match("Punc", ")")) {
+          const after = tokens[pos + 1];
+          if (after && after.type === "Op" && after.value === "=>") {
+            pos = saved;
+            return true;
+          }
+          pos = saved;
+          return false;
+        }
+        pos = saved;
+        return false;
+      }
+      // Spread param: (...rest) =>
+      if (t.type === "Punc" && t.value === "...") {
+        next();
+        if (match("Ident")) { next(); }
+        if (match("Punc", ")")) {
+          const after = tokens[pos + 1];
+          if (after && after.type === "Op" && after.value === "=>") {
+            pos = saved;
+            return true;
+          }
+        }
+        pos = saved;
+        return false;
+      }
+      pos = saved;
+      return false;
+    }
+    pos = saved;
+    return false;
   }
 
-  function parseValue(token) {
-    const t = token.trim();
-    if (t === "true") return true;
-    if (t === "false") return false;
-    if (t === "null") return null;
-    if (t === "undefined") return undefined;
-    if (/^-?\d+(\.\d+)?$/.test(t)) return Number(t);
-    if (/^(['"`]).*\1$/.test(t)) return t.slice(1, -1);
-    // Treat as property path resolved from scope
-    return resolvePath(t, scope);
+  function parseArrowParams() {
+    // Parse comma-separated identifiers until ")"
+    const params = [];
+    if (match("Punc", ")")) return params;
+    if (match("Punc", "...")) {
+      next();
+      if (match("Ident")) params.push("..." + next().value);
+    } else if (match("Ident")) {
+      params.push(next().value);
+    }
+    while (match("Punc", ",")) {
+      next();
+      if (match("Punc", ")")) break;
+      if (match("Punc", "...")) {
+        next();
+        if (match("Ident")) params.push("..." + next().value);
+      } else if (match("Ident")) {
+        params.push(next().value);
+      }
+    }
+    return params;
   }
 
-  const trimmed = expr.trim();
+  // ─── Primary ───
+
+  function parsePrimary() {
+    const t = peek();
+    if (!t) return { type: "Literal", value: undefined };
+
+    // Forbidden token
+    if (t.type === "Forbidden") {
+      next();
+      return { type: "Forbidden" };
+    }
+
+    // Number literal
+    if (t.type === "Number") {
+      next();
+      return { type: "Literal", value: Number(t.value) };
+    }
+
+    // String literal
+    if (t.type === "String") {
+      next();
+      return { type: "Literal", value: t.value };
+    }
+
+    // Template literal
+    if (t.type === "Template") {
+      next();
+      return {
+        type: "TemplateLiteral",
+        parts: t.parts,
+        expressions: t.exprs.map(function(exprTokens) { return _parseExpr(exprTokens); })
+      };
+    }
+
+    // Keywords: true, false, null, undefined
+    if (t.type === "Keyword") {
+      if (t.value === "true") { next(); return { type: "Literal", value: true }; }
+      if (t.value === "false") { next(); return { type: "Literal", value: false }; }
+      if (t.value === "null") { next(); return { type: "Literal", value: null }; }
+      if (t.value === "undefined") { next(); return { type: "Literal", value: undefined }; }
+    }
+
+    // Array literal: [...]
+    if (t.type === "Punc" && t.value === "[") {
+      next();
+      const elements = [];
+      while (!match("Punc", "]") && pos < tokens.length) {
+        elements.push(parseSpreadOrExpr());
+        if (match("Punc", ",")) next();
+      }
+      expect("Punc", "]");
+      return { type: "ArrayExpr", elements };
+    }
+
+    // Object literal: { ... }
+    if (t.type === "Punc" && t.value === "{") {
+      return parseObjectLiteral();
+    }
+
+    // Parenthesized expression or arrow function with parens
+    if (t.type === "Punc" && t.value === "(") {
+      next(); // consume (
+
+      // Check for arrow function: (params) =>
+      if (isArrowParams()) {
+        const params = parseArrowParams();
+        expect("Punc", ")");
+        expect("Op", "=>");
+        const body = parseExpression();
+        return { type: "ArrowFunction", params, body };
+      }
+
+      // Regular grouping
+      const expr = parseExpression();
+      expect("Punc", ")");
+      return expr;
+    }
 
-  // Handle ternary: condition ? trueExpr : falseExpr
-  const ternaryMatch = trimmed.match(/^(.+?)\s*\?\s*(.+?)\s*:\s*(.+)$/);
-  if (ternaryMatch) {
-    const cond = _cspSafeEval(ternaryMatch[1].trim(), keys, vals);
-    return cond
-      ? _cspSafeEval(ternaryMatch[2].trim(), keys, vals)
-      : _cspSafeEval(ternaryMatch[3].trim(), keys, vals);
+    // Identifier (possibly arrow: x => ...)
+    if (t.type === "Ident") {
+      next();
+      // Single-param arrow function: x => expr
+      if (match("Op", "=>")) {
+        next(); // consume =>
+        const body = parseExpression();
+        return { type: "ArrowFunction", params: [t.value], body };
+      }
+      return { type: "Identifier", name: t.value };
+    }
+
+    // Assignment operators
+    if (t.type === "Op" && (t.value === "=" || t.value === "+=" || t.value === "-=" || t.value === "*=" || t.value === "/=" || t.value === "%=")) {
+      // Should not appear as primary; skip
+      next();
+      return { type: "Literal", value: undefined };
+    }
+
+    // Spread in unexpected position (e.g. top level)
+    if (t.type === "Punc" && t.value === "...") {
+      next();
+      return { type: "SpreadElement", argument: parseExpression() };
+    }
+
+    // Fallback: skip unrecognized token
+    next();
+    return { type: "Literal", value: undefined };
   }
 
-  // Handle logical OR (||)
-  if (trimmed.includes("||")) {
-    const parts = trimmed.split("||");
-    for (const part of parts) {
-      const val = _cspSafeEval(part.trim(), keys, vals);
-      if (val) return val;
+  function parseObjectLiteral() {
+    next(); // consume {
+    const properties = [];
+    while (!match("Punc", "}") && pos < tokens.length) {
+      // Spread property: ...expr
+      if (match("Punc", "...")) {
+        next();
+        properties.push({ key: null, value: parseExpression(), computed: false, spread: true });
+        if (match("Punc", ",")) next();
+        continue;
+      }
+
+      // Computed property: [expr]: value
+      if (match("Punc", "[")) {
+        next();
+        const keyExpr = parseExpression();
+        expect("Punc", "]");
+        expect("Punc", ":");
+        const val = parseExpression();
+        properties.push({ key: keyExpr, value: val, computed: true, spread: false });
+        if (match("Punc", ",")) next();
+        continue;
+      }
+
+      // String key: 'key': value
+      if (match("String")) {
+        const keyToken = next();
+        if (match("Punc", ":")) {
+          next();
+          const val = parseExpression();
+          properties.push({ key: keyToken.value, value: val, computed: false, spread: false });
+        }
+        if (match("Punc", ",")) next();
+        continue;
+      }
+
+      // Identifier key (shorthand or key: value)
+      if (match("Ident") || match("Keyword")) {
+        const keyToken = next();
+        if (match("Punc", ":")) {
+          next();
+          const val = parseExpression();
+          properties.push({ key: keyToken.value, value: val, computed: false, spread: false });
+        } else {
+          // Shorthand: { key } → { key: key }
+          properties.push({
+            key: keyToken.value,
+            value: { type: "Identifier", name: keyToken.value },
+            computed: false,
+            spread: false
+          });
+        }
+        if (match("Punc", ",")) next();
+        continue;
+      }
+
+      // Number key
+      if (match("Number")) {
+        const keyToken = next();
+        if (match("Punc", ":")) {
+          next();
+          const val = parseExpression();
+          properties.push({ key: keyToken.value, value: val, computed: false, spread: false });
+        }
+        if (match("Punc", ",")) next();
+        continue;
+      }
+
+      // Unrecognized — skip
+      next();
     }
-    return _cspSafeEval(parts[parts.length - 1].trim(), keys, vals);
+    expect("Punc", "}");
+    return { type: "ObjectExpr", properties };
   }
 
-  // Handle logical AND (&&)
-  if (trimmed.includes("&&")) {
-    const parts = trimmed.split("&&");
-    let last;
-    for (const part of parts) {
-      last = _cspSafeEval(part.trim(), keys, vals);
-      if (!last) return last;
+  // ─── Handle top-level assignment ───
+
+  function parseTopLevel() {
+    const expr = parseExpression();
+    // Check for assignment at top level: ident = expr, ident += expr, etc.
+    const t = peek();
+    if (t && t.type === "Op" && (t.value === "=" || t.value === "+=" || t.value === "-=" || t.value === "*=" || t.value === "/=" || t.value === "%=")) {
+      const op = next().value;
+      const right = parseExpression();
+      return { type: "AssignExpr", op, left: expr, right };
     }
-    return last;
+    return expr;
   }
 
-  // Handle comparisons: ===, !==, ==, !=, >=, <=, >, <
-  const cmpMatch = trimmed.match(/^(.+?)\s*(===|!==|==|!=|>=|<=|>|<)\s*(.+)$/);
-  if (cmpMatch) {
-    const left = parseValue(cmpMatch[1]);
-    const right = parseValue(cmpMatch[3]);
-    switch (cmpMatch[2]) {
-      case "===": return left === right;
-      case "!==": return left !== right;
-      case "==":  return left == right;
-      case "!=":  return left != right;
-      case ">=":  return left >= right;
-      case "<=":  return left <= right;
-      case ">":   return left > right;
-      case "<":   return left < right;
+  const ast = parseTopLevel();
+  return ast;
+}
+
+// ---------------------------------------------------------------------------
+// AST tree-walking evaluator
+// ---------------------------------------------------------------------------
+const _FORBIDDEN_PROPS = { __proto__: 1, constructor: 1, prototype: 1 };
+
+/* Safe subset of JS globals available in expressions (no eval/Function/process) */
+const _SAFE_GLOBALS = {
+  Array, Object, String, Number, Boolean, Math, Date, RegExp, Map, Set,
+  JSON, parseInt, parseFloat, isNaN, isFinite, Infinity, NaN, undefined,
+  Error, Symbol, console,
+};
+
+const _DENY_GLOBALS = { eval: 1, Function: 1, process: 1, require: 1, importScripts: 1 };
+
+function _evalNode(node, scope) {
+  try {
+    if (!node) return undefined;
+
+    switch (node.type) {
+
+      case 'Literal':
+        return node.value;
+
+      case 'Identifier':
+        if (node.name in scope) return scope[node.name];
+        if (node.name in _SAFE_GLOBALS) return _SAFE_GLOBALS[node.name];
+        // Allow access to browser globals (window, document, etc.) for backward compat
+        if (typeof globalThis !== 'undefined' && node.name in globalThis && !_DENY_GLOBALS[node.name]) return globalThis[node.name];
+        return undefined;
+
+      case 'Forbidden':
+        return undefined;
+
+      case 'BinaryExpr': {
+        // Short-circuit operators evaluate lazily
+        if (node.op === '&&') {
+          const l = _evalNode(node.left, scope);
+          return l ? _evalNode(node.right, scope) : l;
+        }
+        if (node.op === '||') {
+          const l = _evalNode(node.left, scope);
+          return l ? l : _evalNode(node.right, scope);
+        }
+        if (node.op === '??') {
+          const l = _evalNode(node.left, scope);
+          return (l === null || l === undefined) ? _evalNode(node.right, scope) : l;
+        }
+        const left = _evalNode(node.left, scope);
+        const right = _evalNode(node.right, scope);
+        switch (node.op) {
+          case '+': return left + right;
+          case '-': return left - right;
+          case '*': return left * right;
+          case '/': return left / right;
+          case '%': return left % right;
+          case '**': return left ** right;
+          case '===': return left === right;
+          case '!==': return left !== right;
+          case '==': return left == right;
+          case '!=': return left != right;
+          case '>': return left > right;
+          case '<': return left < right;
+          case '>=': return left >= right;
+          case '<=': return left <= right;
+          case 'in': return (right && typeof right === 'object') ? (left in right) : undefined;
+          case 'instanceof': return left instanceof right;
+          case '&': return left & right;
+          case '|': return left | right;
+          case '^': return left ^ right;
+          case '<<': return left << right;
+          case '>>': return left >> right;
+          case '>>>': return left >>> right;
+          default: return undefined;
+        }
+      }
+
+      case 'UnaryExpr': {
+        if (node.op === 'typeof') {
+          // Special: if identifier not in scope, return "undefined" string
+          if (node.argument && node.argument.type === 'Identifier' && !(node.argument.name in scope)) {
+            return 'undefined';
+          }
+          return typeof _evalNode(node.argument, scope);
+        }
+        // Prefix ++ / --
+        if (node.op === '++' || node.op === '--') {
+          const oldVal = _evalNode(node.argument, scope);
+          const newVal = node.op === '++' ? oldVal + 1 : oldVal - 1;
+          return node.prefix ? newVal : oldVal;
+        }
+        const arg = _evalNode(node.argument, scope);
+        switch (node.op) {
+          case '!': return !arg;
+          case '-': return -arg;
+          case '+': return +arg;
+          case '~': return ~arg;
+          case 'void': return undefined;
+          default: return undefined;
+        }
+      }
+
+      case 'ConditionalExpr': {
+        return _evalNode(node.test, scope)
+          ? _evalNode(node.consequent, scope)
+          : _evalNode(node.alternate, scope);
+      }
+
+      case 'MemberExpr':
+      case 'OptionalMemberExpr': {
+        const obj = _evalNode(node.object, scope);
+        if (obj == null) return undefined;
+        const prop = node.computed
+          ? _evalNode(node.property, scope)
+          : node.property.name || node.property.value;
+        if (_FORBIDDEN_PROPS[prop]) return undefined;
+        return obj[prop];
+      }
+
+      case 'CallExpr':
+      case 'OptionalCallExpr': {
+        // Evaluate args (handle spread)
+        const evalArgs = (args) => {
+          const result = [];
+          for (let i = 0; i < args.length; i++) {
+            if (args[i].type === 'SpreadElement') {
+              const spread = _evalNode(args[i].argument, scope);
+              if (spread && typeof spread[Symbol.iterator] === 'function') {
+                result.push(...spread);
+              }
+            } else {
+              result.push(_evalNode(args[i], scope));
+            }
+          }
+          return result;
+        };
+
+        if (node.callee.type === 'MemberExpr' || node.callee.type === 'OptionalMemberExpr') {
+          const thisObj = _evalNode(node.callee.object, scope);
+          if (thisObj == null) {
+            if (node.type === 'OptionalCallExpr' || node.callee.type === 'OptionalMemberExpr') return undefined;
+            return undefined;
+          }
+          const prop = node.callee.computed
+            ? _evalNode(node.callee.property, scope)
+            : node.callee.property.name;
+          if (_FORBIDDEN_PROPS[prop]) return undefined;
+          const fn = thisObj[prop];
+          if (typeof fn !== 'function') return undefined;
+          return fn.apply(thisObj, evalArgs(node.args));
+        }
+
+        const fn = _evalNode(node.callee, scope);
+        if (fn == null && node.type === 'OptionalCallExpr') return undefined;
+        if (typeof fn !== 'function') return undefined;
+        return fn.apply(undefined, evalArgs(node.args));
+      }
+
+      case 'ArrayExpr': {
+        const arr = [];
+        for (let i = 0; i < node.elements.length; i++) {
+          const el = node.elements[i];
+          if (el.type === 'SpreadElement') {
+            const spread = _evalNode(el.argument, scope);
+            if (spread && typeof spread[Symbol.iterator] === 'function') {
+              arr.push(...spread);
+            }
+          } else {
+            arr.push(_evalNode(el, scope));
+          }
+        }
+        return arr;
+      }
+
+      case 'ObjectExpr': {
+        const obj = {};
+        for (let i = 0; i < node.properties.length; i++) {
+          const prop = node.properties[i];
+          if (prop.spread) {
+            Object.assign(obj, _evalNode(prop.value, scope));
+          } else {
+            const key = prop.computed ? _evalNode(prop.key, scope) : prop.key;
+            if (_FORBIDDEN_PROPS[key]) continue;
+            obj[key] = _evalNode(prop.value, scope);
+          }
+        }
+        return obj;
+      }
+
+      case 'SpreadElement':
+        return _evalNode(node.argument, scope);
+
+      case 'ArrowFunction':
+        return function (...callArgs) {
+          const childScope = Object.create(scope);
+          for (let i = 0; i < node.params.length; i++) {
+            const p = node.params[i];
+            if (typeof p === 'string' && p.startsWith('...')) {
+              childScope[p.slice(3)] = callArgs.slice(i);
+              break;
+            }
+            childScope[p] = callArgs[i];
+          }
+          return _evalNode(node.body, childScope);
+        };
+
+      case 'TemplateLiteral': {
+        let result = node.parts[0];
+        for (let i = 0; i < node.expressions.length; i++) {
+          result += String(_evalNode(node.expressions[i], scope));
+          result += node.parts[i + 1];
+        }
+        return result;
+      }
+
+      case 'PostfixExpr': {
+        // In expression context, return the current value (no mutation)
+        return _evalNode(node.argument, scope);
+      }
+
+      case 'AssignExpr': {
+        // In expression context, evaluate and return the RHS
+        return _evalNode(node.right, scope);
+      }
+
+      default:
+        return undefined;
     }
+  } catch (_e) {
+    return undefined;
   }
+}
 
-  // Handle negation
-  if (trimmed.startsWith("!")) {
-    return !_cspSafeEval(trimmed.slice(1).trim(), keys, vals);
+// ---------------------------------------------------------------------------
+// Statement parser & executor (for on:*, watch, etc.)
+// ---------------------------------------------------------------------------
+
+// Parse semicolon-separated statements into an array of AST nodes
+function _parseStatements(expr) {
+  if (_stmtCache.has(expr)) return _stmtCache.get(expr);
+  const tokens = _tokenize(expr);
+  const stmts = [];
+  let start = 0;
+  for (let i = 0; i <= tokens.length; i++) {
+    if (i === tokens.length || (tokens[i].type === "Punc" && tokens[i].value === ";")) {
+      const chunk = tokens.slice(start, i);
+      if (chunk.length > 0) stmts.push(_parseExpr(chunk));
+      start = i + 1;
+    }
   }
+  _stmtCache.set(expr, stmts);
+  return stmts;
+}
 
-  return parseValue(trimmed);
+// Assign a value to an AST target node (Identifier or MemberExpr)
+function _assignToTarget(target, value, scope) {
+  if (target.type === "Identifier") {
+    scope[target.name] = value;
+  } else if (target.type === "MemberExpr" || target.type === "OptionalMemberExpr") {
+    const obj = _evalNode(target.object, scope);
+    if (obj == null) return;
+    const prop = target.computed
+      ? _evalNode(target.property, scope)
+      : target.property.name || target.property.value;
+    if (_FORBIDDEN_PROPS[prop]) return;
+    obj[prop] = value;
+  }
+}
+
+// Execute a single statement node with mutation support
+function _execStmtNode(node, scope) {
+  if (!node) return undefined;
+  switch (node.type) {
+    case "AssignExpr": {
+      const rhs = _evalNode(node.right, scope);
+      let value;
+      if (node.op === "=") {
+        value = rhs;
+      } else {
+        const lhs = _evalNode(node.left, scope);
+        switch (node.op) {
+          case "+=": value = lhs + rhs; break;
+          case "-=": value = lhs - rhs; break;
+          case "*=": value = lhs * rhs; break;
+          case "/=": value = lhs / rhs; break;
+          case "%=": value = lhs % rhs; break;
+          default: value = rhs;
+        }
+      }
+      _assignToTarget(node.left, value, scope);
+      return value;
+    }
+    case "PostfixExpr": {
+      const oldVal = _evalNode(node.argument, scope);
+      const newVal = node.op === "++" ? oldVal + 1 : oldVal - 1;
+      _assignToTarget(node.argument, newVal, scope);
+      return oldVal;
+    }
+    case "UnaryExpr": {
+      if (node.op === "++" || node.op === "--") {
+        const oldVal = _evalNode(node.argument, scope);
+        const newVal = node.op === "++" ? oldVal + 1 : oldVal - 1;
+        _assignToTarget(node.argument, newVal, scope);
+        return newVal;
+      }
+      return _evalNode(node, scope);
+    }
+    default: {
+      // In statement context, throw for undefined function calls
+      // so error-boundary directives can catch the error
+      if (node.type === "CallExpr" && node.callee.type === "Identifier") {
+        const name = node.callee.name;
+        if (!(name in scope) && !(name in _SAFE_GLOBALS) &&
+            (typeof globalThis === "undefined" || !(name in globalThis))) {
+          throw new ReferenceError(name + " is not defined");
+        }
+      }
+      return _evalNode(node, scope);
+    }
+  }
 }
 
 // Parse pipe syntax: "expr | filter1 | filter2:arg"
@@ -211,22 +1140,20 @@ export function evaluate(expr, ctx) {
       }
     }
 
-    const keyArr = keys;
-    const valArr = keyArr.map((k) => vals[k]);
+    // Build scope object from keys/vals
+    const scope = {};
+    for (let i = 0; i < keys.length; i++) scope[keys[i]] = vals[keys[i]];
 
-    let result;
-    if (_config.csp === "strict") {
-      result = _cspSafeEval(mainExpr, keyArr, valArr);
-    } else {
-      let cacheKey = mainExpr + "|" + keyArr.join(",");
-      let fn = _exprCache.get(cacheKey);
-      if (!fn) {
-        fn = new Function(...keyArr, `return (${mainExpr})`);
-        _exprCache.set(cacheKey, fn);
-      }
-      result = fn(...valArr);
+    // Parse expression into AST (cached)
+    let ast = _exprCache.get(mainExpr);
+    if (!ast) {
+      ast = _parseExpr(_tokenize(mainExpr));
+      _exprCache.set(mainExpr, ast);
     }
 
+    // Evaluate AST against scope
+    let result = _evalNode(ast, scope);
+
     // Apply filters
     for (let i = 1; i < pipes.length; i++) {
       result = _applyFilter(result, pipes[i]);
@@ -234,6 +1161,7 @@ export function evaluate(expr, ctx) {
 
     return result;
   } catch (e) {
+    _warn("Expression error:", expr, e.message);
     return undefined;
   }
 }
@@ -258,35 +1186,53 @@ export function _execStatement(expr, ctx, extraVars = {}) {
       }
     }
 
-    const keyArr = [...keys];
-    const valArr = keyArr.map((k) => vals[k]);
+    // Build scope
+    const scope = {};
+    for (let i = 0; i < keys.length; i++) scope[keys[i]] = vals[keys[i]];
 
-    // Build setters to write back state through the full context chain.
-    // For each key in any ancestor context, find the owning context at runtime
-    // and call $set on it — so mutations inside `each` loops correctly
-    // propagate back to parent state (e.g. cart updated from a loop's on:click).
-    // Only write back values that actually changed locally, to avoid
-    // overwriting proxy mutations made by called functions.
+    // Snapshot context chain values for write-back comparison
     const chainKeys = new Set();
     let _wCtx = ctx;
     while (_wCtx && _wCtx.__isProxy) {
       for (const k of Object.keys(_wCtx.__raw)) chainKeys.add(k);
       _wCtx = _wCtx.$parent;
     }
-    const origObj = {};
+    const originals = {};
     for (const k of chainKeys) {
-      if (!k.startsWith("$") && k in vals) origObj[k] = vals[k];
-    }
-    const setters = [...chainKeys]
-      .filter((k) => !k.startsWith("$"))
-      .map(
-        (k) =>
-          `{let _c=__ctx;while(_c&&_c.__isProxy){if('${k}'in _c.__raw){if(typeof ${k}!=='undefined'){if(${k}!==__orig['${k}'])_c.$set('${k}',${k});else if(typeof ${k}==='object'&&${k}!==null)_c.$notify();}break;}_c=_c.$parent;}}`,
-      )
-      .join("\n");
-
-    const fn = new Function("__ctx", "__orig", ...keyArr, `${expr};\n${setters}`);
-    fn(ctx, origObj, ...valArr);
+      if (!k.startsWith("$") && k in scope) originals[k] = scope[k];
+    }
+
+    // Parse and execute statements
+    const stmts = _parseStatements(expr);
+    for (let i = 0; i < stmts.length; i++) _execStmtNode(stmts[i], scope);
+
+    // Write back changed values to owning context
+    for (const k of chainKeys) {
+      if (k.startsWith("$")) continue;
+      if (!(k in scope)) continue;
+      const newVal = scope[k];
+      const oldVal = originals[k];
+      if (newVal !== oldVal) {
+        let c = ctx;
+        while (c && c.__isProxy) {
+          if (k in c.__raw) { c.$set(k, newVal); break; }
+          c = c.$parent;
+        }
+      } else if (typeof newVal === "object" && newVal !== null) {
+        let c = ctx;
+        while (c && c.__isProxy) {
+          if (k in c.__raw) { c.$notify(); break; }
+          c = c.$parent;
+        }
+      }
+    }
+
+    // Write back new variables created during execution
+    for (const k in scope) {
+      if (k.startsWith("$") || chainKeys.has(k)) continue;
+      if (k in vals) continue;
+      ctx.$set(k, scope[k]);
+    }
 
     // Notify global store watchers when expression touches $store
     if (typeof expr === "string" && expr.includes("$store")) {