@hona/openeval 0.3.3 → 0.5.0

package/src/app/read-results.ts

@@ -1,5 +1,5 @@
-import { readdir } from "node:fs/promises";
-import { resolve, dirname } from "node:path";
+import { readdir, realpath } from "node:fs/promises";
+import { resolve, dirname, sep } from "node:path";
 import { Results } from "../infra/sqlite";
 import type { BenchmarkRun, EvalRun, JudgeRun, Slot, Cost } from "../types";
 import type {
@@ -14,7 +14,7 @@ import type {
   StageStatus,
   JudgeAudit,
 } from "../view";
-import { sumCosts } from "../view";
+import { categoryCatalog, sumCosts } from "../view";
 import { benchmarkScores } from "./scores";
 import { executionRuntime } from "./execution-runtime";
 import {
@@ -26,7 +26,7 @@ import {
 } from "../runtime";
 import { canJudgeEval } from "./eval-state";
 import { CandidateEvidence, type EvidenceQuery } from "../infra/evidence";
-import { contained } from "../infra/files";
+import { contained, hash } from "../infra/files";
 
 const scheduled = (slot: Slot, benchmark: BenchmarkRun, now: number) =>
   benchmark.state === "running" &&
@@ -167,7 +167,7 @@ export class ResultReader {
     if (!judge) throw new Error("Unknown judge run");
     const candidate = results.evalRun(judge.input.evalRunId);
     const criteria = new Map(
-      judge.input.criteria.map((criterion) => [criterion.id, criterion]),
+      [...judge.input.criteria, ...judge.input.codeCriteria ?? []].map((criterion) => [criterion.id, criterion]),
     );
     for (const id of Object.keys(judge.judgment?.scores ?? {}))
       if (!criteria.has(id))
@@ -225,6 +225,23 @@ export class ResultReader {
         })),
     };
   }
+  async verificationEvidence(benchmarkId: string, judgeRunId: string, id: string, path?: string) {
+    using results = await this.database(benchmarkId);
+    const judge = results.judgeRun(judgeRunId);
+    const verification = judge?.code?.verifications?.find(item => item.id === id);
+    if (!verification) throw new Error("Unknown verification");
+    if (!path) return { receipt: verification };
+    const artifact = verification.artifacts.find(item => item.path === path);
+    const file = path === "stdout" ? verification.stdout : path === "stderr" ? verification.stderr : artifact?.file;
+    if (!file) throw new Error("Unknown verification artifact");
+    const root = await realpath(dirname(results.path));
+    const target = await realpath(contained(root, file));
+    if (target !== root && !target.startsWith(root + sep)) throw new Error("Verification artifact leaves its run directory");
+    const bytes = await Bun.file(target).bytes();
+    if (bytes.length > 32 * 1024 * 1024 || (artifact && hash(bytes) !== artifact.sha256))
+      throw new Error("Verification artifact is too large or its hash differs");
+    return { bytes, path };
+  }
   async checkEvidence(
     benchmarkId: string,
     judgeRunId: string,
@@ -316,6 +333,7 @@ export class ResultReader {
           evals.map((item) => [item.id, item.name]),
         ),
         modelNames: run.modelNames ?? {},
+        categories: categoryCatalog(scores[0]?.components ?? []),
         cost: evalId ? evalCosts[evalId] : sumCosts(Object.values(evalCosts)),
         evalCosts,
         runtime,

package/src/app/rejudge.ts

@@ -7,6 +7,7 @@ import { judgeEvalRun } from "./judge-run";
 import { executeQueue, finishBenchmark } from "./run-benchmark";
 import { judgingFingerprint } from "../infra/judging";
 import { canJudgeEval } from "./eval-state";
+import { verificationRuntime } from "../infra/verification/image";
 
 /** Rejudging changes only the selected judgment. The candidate execution is never repeated. */
 export async function judgeRun(
@@ -59,6 +60,8 @@ export async function judgeRuns(
             judgeHash: updated.judgeHash,
             criteria: updated.criteria,
             code: updated.code,
+            codeCriteria: updated.codeCriteria,
+            categories: updated.categories,
             name: updated.name,
           }
         : evalDefinition;
@@ -67,7 +70,9 @@ export async function judgeRuns(
   const runtime = {
     ...previous.runtime,
     judgeHash: await judgingFingerprint(),
+    verification: await verificationRuntime(definition.judge.verification),
   };
+  if (runtime.verification) definition.judge.verification = runtime.verification;
   const selected = new Set(candidates.map((candidate) => candidate.slotId));
   results.transaction(() => {
     if (results.benchmark?.state === "running")

package/src/app/run-benchmark.ts

@@ -23,6 +23,11 @@ import { canJudgeEval } from "./eval-state";
 import { isScored } from "../judgment";
 import { benchmarkScores } from "./scores";
 import { CostBudget, estimateWork } from "./cost-plan";
+import {
+  categoryKey,
+  categoryList,
+  inCategories,
+} from "../criterion-categories";
 
 export type RunBenchmarkOptions = {
   directory?: string;
@@ -32,6 +37,8 @@ export type RunBenchmarkOptions = {
   /** Execute work only for these models while retaining the full aggregate. */
   onlyModels?: readonly ModelRef[];
   onlyEvals?: readonly string[];
+  /** Execute only evals with a criterion in any of these categories. */
+  onlyCategories?: readonly string[];
   onlyRepetitions?: readonly number[];
   /** Stop admitting work when reported spend plus reservations reaches this amount. */
   maxCostUSD?: number;
@@ -39,6 +46,29 @@ export type RunBenchmarkOptions = {
   onEvent?: ExecutionObserver;
 };
 
+/** Intersect --only-eval with evals that have a criterion in any --only-category. */
+function scopedEvals(
+  definition: BenchmarkDefinition,
+  options: Pick<RunBenchmarkOptions, "onlyEvals" | "onlyCategories">,
+) {
+  if (!options.onlyCategories) return options.onlyEvals;
+  const keys = categoryList(options.onlyCategories, "--only-category").map(
+    categoryKey,
+  );
+  if (!keys.length) throw new Error("Select at least one category");
+  const matching = definition.evals
+    .filter((item) =>
+      Object.values(item.categories ?? {}).some((names) =>
+        inCategories({ categories: names }, keys),
+      ),
+    )
+    .map((item) => item.id)
+    .filter((id) => !options.onlyEvals || options.onlyEvals.includes(id));
+  if (!matching.length)
+    throw new Error("No selected evals have criteria in these categories");
+  return matching;
+}
+
 export async function currentBenchmarkRun(directory: string) {
   const root = resolve(directory, "results");
   const dirs = (await readdir(root, { withFileTypes: true }).catch(() => []))
@@ -141,11 +171,13 @@ export async function runBenchmark(
       ))
   )
     throw new Error("Select configured eval IDs with --only-eval");
+  const onlyEvals = scopedEvals(definition, options);
   new CostBudget(options.maxCostUSD, () => 0);
   const selected = options.onlyModels?.map(modelRef);
   if (selected && !selected.length)
     throw new Error("Select at least one model");
-  const runtime = await runtimeFingerprint(definition.container);
+  const runtime = await runtimeFingerprint(definition.container, definition.judge.verification);
+  if (runtime.verification) definition.judge.verification = runtime.verification;
   let directory =
     options.directory ??
     (!options.fresh
@@ -192,11 +224,11 @@ export async function runBenchmark(
     results.slots().map((slot) => [slot.id, slot]),
   );
   let plan = planBenchmark(definition, runtime, results);
-  if (selected || options.onlyEvals || options.onlyRepetitions) {
+  if (selected || onlyEvals || options.onlyRepetitions) {
     const retained = new Map(results.slots().map((slot) => [slot.id, slot]));
     plan = plan.map((item) =>
       ((!selected || selected.includes(item.slot.model)) &&
-        (!options.onlyEvals || options.onlyEvals.includes(item.slot.evalId)) &&
+        (!onlyEvals || onlyEvals.includes(item.slot.evalId)) &&
         (!options.onlyRepetitions ||
           options.onlyRepetitions.includes(item.slot.repetition))) ||
       item.action === "reuse"
@@ -244,7 +276,7 @@ export async function runBenchmark(
     execution: {
       startedAt: now,
       onlyModels: selected,
-      onlyEvals: options.onlyEvals,
+      onlyEvals,
       onlyRepetitions: options.onlyRepetitions,
       budgetUSD: options.maxCostUSD,
       estimatedUSD: estimate.estimatedUSD,

package/src/app/scores.ts

@@ -1,6 +1,7 @@
 import type { BenchmarkDefinition, JudgeRun, Slot } from "../types";
 import { modelScore } from "../view";
 import { isScored } from "../judgment";
+import { categoryKey, inCategories } from "../criterion-categories";
 
 /** Scores are derived from a single selection snapshot; every eval has equal weight. */
 export function benchmarkScores(
@@ -13,10 +14,14 @@ export function benchmarkScores(
   const evals = definition.evals.filter(
     (item) => !evalId || item.id === evalId,
   );
+  const keys = definition.categories?.map(categoryKey);
   const definitions = new Map(
     evals.map((item) => {
       const criteria = new Map(
-        item.criteria.map((criterion) => [criterion.id, criterion]),
+        [...item.criteria, ...(item.codeCriteria ?? [])].map((criterion) => [
+          criterion.id,
+          criterion,
+        ]),
       );
       for (const slot of slots.filter(
         (slot) => slot.active && slot.evalId === item.id,
@@ -28,7 +33,16 @@ export function benchmarkScores(
           if (!criteria.has(id))
             criteria.set(id, { id, name: id.replaceAll("_", " ") });
       }
-      return [item.id, [...criteria.values()]];
+      const categorized = [...criteria.values()].map((criterion) => ({
+        ...criterion,
+        categories: item.categories?.[criterion.id] ?? [],
+      }));
+      return [
+        item.id,
+        keys
+          ? categorized.filter((criterion) => inCategories(criterion, keys))
+          : categorized,
+      ];
     }),
   );
   return definition.models.map((model) =>
@@ -57,6 +71,9 @@ export function benchmarkScores(
             eval: item.id,
             criterion: criterion.id,
             name: criterion.name,
+            ...(criterion.categories.length
+              ? { categories: criterion.categories }
+              : {}),
             value:
               values.length === definition.repetitions
                 ? scoredSum / definition.repetitions

package/src/app/serve-results.ts

@@ -52,6 +52,20 @@ export async function serveResults(options: {
               url.searchParams.get("judge") ?? "",
             ),
           );
+        if (url.pathname === "/api/verification") {
+          const result = await reader.verificationEvidence(
+            url.searchParams.get("benchmark") ?? "", url.searchParams.get("judge") ?? "",
+            url.searchParams.get("id") ?? "", url.searchParams.get("path") ?? undefined,
+          );
+          if ("receipt" in result) return Response.json(result);
+          const mime = /\.png$/i.test(result.path) ? "image/png" : /\.jpe?g$/i.test(result.path) ? "image/jpeg" :
+            /\.webp$/i.test(result.path) ? "image/webp" : "text/plain; charset=utf-8";
+          return new Response(result.bytes, { headers: {
+            "Content-Type": mime, "X-Content-Type-Options": "nosniff",
+            "Content-Security-Policy": "default-src 'none'; sandbox",
+            "Cache-Control": "no-store",
+          } });
+        }
         if (url.pathname === "/api/check-evidence") {
           const query: EvidenceQuery = {
             action: (url.searchParams.get("action") ??

package/src/cli.ts

@@ -12,6 +12,9 @@ import {
   serveResults,
   mergeBenchmarkRuns,
   snapshotBenchmarkRun,
+  buildVerificationImage,
+  VERIFICATION_IMAGE,
+  prepareInputs,
 } from "./index";
 import type { ModelRef } from "./index";
 
@@ -35,6 +38,7 @@ try {
 Commands:
   image                 Build the candidate container image
   plan                  Show missing or changed work without executing it
+  prepare               Prepare and archive inputs without model calls
   run                   Execute missing or changed work in the current result
   view                  Serve the results viewer
   snapshot <run> <name>  Export a score snapshot
@@ -51,17 +55,33 @@ Options:
   --model <provider/id>  Model to add or remove (repeatable)
   --only-model <ref>     Execute only this model (repeatable)
   --only-eval <id>       Execute only this eval (repeatable)
+  --only-category <name> Execute only evals with criteria in this category (repeatable)
   --only-repetition <n>  Execute only this repetition (repeatable)
   --max-cost <usd>       Scheduling budget for this invocation
   --final-only          Judge only after candidates finish
+  --verification        Build only the standard verification image (image command)
+  --output <dir>         New prepared-input directory (prepare command)
   --port <port>         Viewer port (default: 4173)
 
 Requires Bun 1.4.2+, Docker, and an authenticated OpenCode installation.`);
   } else if (command === "--version") {
     console.log((await Bun.file(new URL("../package.json", import.meta.url)).json()).version);
   } else if (command === "image") {
-    await buildImage((await loadBenchmark(benchmark)).container);
-    console.log("Candidate image ready");
+    const definition = await loadBenchmark(benchmark);
+    if (!args.includes("--verification")) {
+      await buildImage(definition.container);
+      console.log("Candidate image ready");
+    }
+    const verification = definition.judge.verification ?? (args.includes("--verification")
+      ? { image: VERIFICATION_IMAGE, engine: definition.container.engine } : undefined);
+    if (verification) {
+      await buildVerificationImage(verification);
+      console.log("Verification image ready");
+    }
+  } else if (command === "prepare") {
+    if (!option("--output")) throw new Error("prepare requires --output with a new directory");
+    const onlyEvals = args.flatMap((arg, index) => arg === "--only-eval" ? [args[index + 1]] : []);
+    console.log(JSON.stringify(await prepareInputs(benchmark, { directory: option("--output")!, onlyEvals: onlyEvals.length ? onlyEvals : undefined }), null, 2));
   } else if (command === "view") {
     const viewer = await serveResults({
       resultsPath: resolve(benchmark, "results"),
@@ -84,6 +104,11 @@ Requires Bun 1.4.2+, Docker, and an authenticated OpenCode installation.`);
             arg === "--only-eval" ? [args[index + 1]] : [],
           )
         : undefined,
+      onlyCategories: args.includes("--only-category")
+        ? args.flatMap((arg, index) =>
+            arg === "--only-category" ? [args[index + 1]] : [],
+          )
+        : undefined,
       maxCostUSD: args.includes("--max-cost")
         ? Number(option("--max-cost"))
         : undefined,

package/src/criterion-categories.ts

@@ -0,0 +1,53 @@
+/** Categories are reporting metadata: any non-empty string, matched case-insensitively. */
+export const categoryKey = (name: string) => name.trim().toLowerCase();
+
+/** Trim names and drop case-insensitive duplicates, keeping the first spelling. */
+export function categoryList(values: readonly unknown[], where: string) {
+  const names: string[] = [],
+    keys = new Set<string>();
+  for (const value of values) {
+    if (typeof value !== "string" || !value.trim())
+      throw new Error(`${where}: categories must be non-empty strings`);
+    const name = value.trim();
+    if (keys.has(categoryKey(name))) continue;
+    keys.add(categoryKey(name));
+    names.push(name);
+  }
+  return names;
+}
+
+const CATEGORY_LINE = /^Categor(?:y|ies):[ \t]*(.*?)\r?$/i;
+const HEADING = /^## Criterion: ([a-z][a-z0-9_]*)[ \t]*[—–-]/;
+
+/** Reads the optional `Categories:` line directly below each `## Criterion:` heading.
+ * The returned rubric omits those lines, so adding or changing categories never
+ * changes judge input or judge fingerprints.
+ */
+export function rubricCategories(rubric: string) {
+  const lines = rubric.split("\n"),
+    kept: string[] = [],
+    categories: Record<string, string[]> = {};
+  for (let index = 0; index < lines.length; index++) {
+    const line = lines[index]!;
+    if (CATEGORY_LINE.test(line))
+      throw new Error(
+        "Put a Categories: line directly below its ## Criterion: heading",
+      );
+    kept.push(line);
+    const heading = HEADING.exec(line),
+      next = heading ? CATEGORY_LINE.exec(lines[index + 1] ?? "") : null;
+    if (!heading || !next) continue;
+    categories[heading[1]!] = categoryList(
+      next[1]!.split(","),
+      `Criterion ${heading[1]}`,
+    );
+    index++;
+  }
+  return { rubric: kept.join("\n"), categories };
+}
+
+/** Whether a scored criterion belongs to any of the selected category keys. */
+export const inCategories = (
+  part: { categories?: readonly string[] },
+  keys: readonly string[],
+) => !!part.categories?.some((name) => keys.includes(categoryKey(name)));

package/src/index.ts

@@ -9,6 +9,7 @@ export type {
   JudgeRun,
   Judgment,
   CriterionDefinition,
+  CodeCriteria,
   CriterionScore,
   EvidenceCitation,
   ToolCall,
@@ -31,6 +32,10 @@ export type {
 } from "./evidence";
 export { CANDIDATE_TIMEOUT_MS } from "./types";
 export { rubricCriteria, criterionMean, isScored } from "./judgment";
+export {
+  categoryKey,
+  rubricCategories,
+} from "./criterion-categories";
 export type {
   JudgeContext,
   JudgeFunction,
@@ -41,8 +46,16 @@ export type {
   RecordedEvent,
   RecordedMessage,
   RecordedFile,
+  CodeScore,
+  VerificationEnvironment,
+  VerificationRuntime,
+  VerificationRequest,
+  VerificationResult,
+  VerificationArtifact,
 } from "./judge-context";
+export { buildVerificationImage, VERIFICATION_IMAGE } from "./infra/verification/image";
 export { loadBenchmark } from "./app/load-benchmark";
+export { prepareInputs } from "./app/prepare-inputs";
 export {
   runBenchmark,
   currentBenchmarkRun,

package/src/infra/containers/catalog.ts

@@ -1,18 +1,64 @@
 import { mkdir, mkdtemp, rm } from "node:fs/promises";
 import { tmpdir } from "node:os";
 import { resolve } from "node:path";
-import type { BenchmarkDefinition, ModelNames } from "../../types";
+import type {
+  BenchmarkDefinition,
+  ModelNames,
+  ModelRef,
+  ProviderDefinitions,
+} from "../../types";
 import { CandidateContainer } from "./oci";
 import { createSessionDatabase } from "../opencode/host";
 import { createCredentialSnapshot, integrationFor } from "../opencode/auth";
 import { clientFor, parseModel } from "../opencode/session";
+import { candidateProviders } from "../../app/input-fingerprints";
 
 const CATALOG_TIMEOUT_MS = 60_000;
 
-/** Display names from the candidates' OpenCode catalog, including declared provider overrides. */
+type CatalogDefinition = Pick<
+  BenchmarkDefinition,
+  "models" | "candidate" | "container"
+>;
+
+/** Display names from the candidates' OpenCode catalog, including declared provider overrides.
+ * Like candidates, each container receives only one integration's credentials and its models' provider configuration.
+ */
 export async function readModelNames(
-  definition: Pick<BenchmarkDefinition, "models" | "candidate" | "container">,
+  definition: CatalogDefinition,
+  imageId: string,
+): Promise<ModelNames> {
+  const names = await Promise.all(
+    catalogRequests(definition).map((request) =>
+      readIntegrationNames(definition.container, imageId, request).catch(
+        () => ({}),
+      ),
+    ),
+  );
+  return Object.assign({}, ...names);
+}
+
+export type CatalogRequest = {
+  integration: string;
+  models: readonly ModelRef[];
+  providers?: ProviderDefinitions;
+};
+
+/** One request per credential integration, scoped like the candidates it names. */
+export const catalogRequests = (
+  definition: Pick<BenchmarkDefinition, "models" | "candidate">,
+): CatalogRequest[] =>
+  [...Map.groupBy(definition.models, integrationFor)].map(
+    ([integration, models]) => ({
+      integration,
+      models,
+      providers: scopedProviders(definition.candidate.providers, models),
+    }),
+  );
+
+async function readIntegrationNames(
+  container: BenchmarkDefinition["container"],
   imageId: string,
+  { integration, models, providers }: CatalogRequest,
 ): Promise<ModelNames> {
   const staging = await mkdtemp(
     resolve(process.env.TMP ?? tmpdir(), "catalog-"),
@@ -23,31 +69,19 @@ export async function readModelNames(
     await mkdir(workspace);
     await createSessionDatabase(
       database,
-      createCredentialSnapshot(undefined, [
-        ...new Set(definition.models.map(integrationFor)),
-      ]),
-    );
-    await using container = await CandidateContainer.create(
-      definition.container,
-      imageId,
-    );
-    await container.prepare(
-      workspace,
-      database,
-      false,
-      [],
-      staging,
-      definition.candidate.providers,
+      createCredentialSnapshot(undefined, [integration]),
     );
+    await using catalog = await CandidateContainer.create(container, imageId);
+    await catalog.prepare(workspace, database, false, [], staging, providers);
     const client = clientFor(
-      await container.start(CATALOG_TIMEOUT_MS),
-      container.password,
+      await catalog.start(CATALOG_TIMEOUT_MS),
+      catalog.password,
     );
     const location = { directory: "/workspace" };
     await client.plugin.awaitActivation({ location });
     const listed = (await client.model.list({ location })).data;
     return Object.fromEntries(
-      definition.models.flatMap((model) => {
+      models.flatMap((model) => {
         const selected = parseModel(model),
           found = listed.find(
             (item) =>
@@ -68,3 +102,25 @@ export async function readModelNames(
     });
   }
 }
+
+/** Union of what each listed candidate would receive, without other providers' entries. */
+function scopedProviders(
+  providers: ProviderDefinitions | undefined,
+  models: readonly ModelRef[],
+): ProviderDefinitions | undefined {
+  let scoped: NonNullable<ProviderDefinitions> | undefined;
+  for (const model of models)
+    for (const [id, entry] of Object.entries(
+      candidateProviders(providers, model) ?? {},
+    )) {
+      scoped ??= {};
+      scoped[id] = {
+        ...scoped[id],
+        ...entry,
+        ...(scoped[id]?.models || entry.models
+          ? { models: { ...scoped[id]?.models, ...entry.models } }
+          : {}),
+      };
+    }
+  return scoped;
+}

package/src/infra/containers/oci.ts

@@ -12,6 +12,7 @@ import { extractWorkspaceArchive } from "./transfer";
 import { treeHash, fingerprint, writeJson } from "../files";
 import { OPENCODE_VERSION } from "../opencode/host";
 import { judgingFingerprint } from "../judging";
+import { verificationRuntime } from "../verification/image";
 
 const runtimeDirectory = fileURLToPath(new URL("./runtime/", import.meta.url));
 export async function buildImage(config: BenchmarkDefinition["container"]) {
@@ -46,8 +47,10 @@ export async function inspectImage(config: BenchmarkDefinition["container"]) {
 }
 export async function runtimeFingerprint(
   config: BenchmarkDefinition["container"],
+  verification?: BenchmarkDefinition["judge"]["verification"],
 ) {
   const imageId = await inspectImage(config);
+  const verified = await verificationRuntime(verification);
   return {
     imageId,
     candidateHash: fingerprint({
@@ -80,6 +83,7 @@ export async function runtimeFingerprint(
       ),
     }),
     judgeHash: await judgingFingerprint(),
+    ...(verified ? { verification: verified } : {}),
   };
 }
 

package/src/infra/judging/code-criteria.ts

@@ -0,0 +1,112 @@
+const EXPORT = /export\s+const\s+criteria\s*=\s*/;
+
+/** Reads judge.ts's `export const criteria = { … }` as data, without executing the judge.
+ * Only object, array, string, number, and boolean literals are accepted.
+ */
+export async function readCodeCriteria(file: string): Promise<unknown> {
+  const transpiler = new Bun.Transpiler({ loader: "ts" }),
+    source = transpiler.transformSync(await Bun.file(file).text()),
+    start = EXPORT.exec(source);
+  if (start)
+    return new LiteralParser(source, start.index + start[0].length).value();
+  if (transpiler.scan(source).exports.includes("criteria"))
+    throw new Error(
+      "Declare judge.ts criteria as `export const criteria = { … }`",
+    );
+  return undefined;
+}
+
+class LiteralParser {
+  constructor(
+    private source: string,
+    private index: number,
+  ) {}
+  private fail(): never {
+    throw new Error(
+      "judge.ts criteria must be a literal object of names and categories",
+    );
+  }
+  private space() {
+    for (;;) {
+      const rest = this.source.slice(this.index);
+      const skipped = /^(?:\s+|\/\/[^\n]*|\/\*[\s\S]*?\*\/)/.exec(rest);
+      if (!skipped) return;
+      this.index += skipped[0].length;
+    }
+  }
+  private peek() {
+    this.space();
+    return this.source[this.index];
+  }
+  private take(token: string) {
+    if (this.peek() !== token) this.fail();
+    this.index++;
+  }
+  value(): unknown {
+    const next = this.peek();
+    if (next === "{") return this.object();
+    if (next === "[") return this.array();
+    if (next === '"' || next === "'" || next === "`") return this.string();
+    const literal =
+      /^(?:true|false|-?\d+(?:\.\d+)?)(?![\w$])/.exec(
+        this.source.slice(this.index),
+      )?.[0];
+    if (!literal) this.fail();
+    this.index += literal.length;
+    return literal === "true" ? true : literal === "false" ? false : Number(literal);
+  }
+  private object() {
+    this.take("{");
+    const value: Record<string, unknown> = {};
+    while (this.peek() !== "}") {
+      const key =
+        this.peek() === '"' || this.peek() === "'"
+          ? this.string()
+          : this.identifier();
+      this.take(":");
+      value[key] = this.value();
+      if (this.peek() !== ",") break;
+      this.index++;
+    }
+    this.take("}");
+    return value;
+  }
+  private array() {
+    this.take("[");
+    const value: unknown[] = [];
+    while (this.peek() !== "]") {
+      value.push(this.value());
+      if (this.peek() !== ",") break;
+      this.index++;
+    }
+    this.take("]");
+    return value;
+  }
+  private identifier() {
+    const name = /^[A-Za-z_$][\w$]*/.exec(this.source.slice(this.index))?.[0];
+    if (!name) this.fail();
+    this.index += name.length;
+    return name;
+  }
+  private string() {
+    const quote = this.source[this.index]!;
+    let value = "";
+    for (this.index++; this.index < this.source.length; this.index++) {
+      const char = this.source[this.index]!;
+      if (char === quote) {
+        this.index++;
+        return value;
+      }
+      if (quote === "`" && char === "$" && this.source[this.index + 1] === "{")
+        this.fail();
+      if (char === "\\") {
+        const escaped = this.source[++this.index]!;
+        value +=
+          { n: "\n", t: "\t", r: "\r", "0": "\0" }[escaped] ?? escaped;
+        continue;
+      }
+      value += char;
+    }
+    this.fail();
+  }
+}