@readymadeit/mcp 0.0.0-stage → 0.1.0

package/bundle/hkp-node/src/credentialedFetch.ts

@@ -0,0 +1,122 @@
+/**
+ * A request whose headers may name secrets, sent so that each secret reaches
+ * only the hosts its audience allows — the first one and every one a redirect
+ * leads to.
+ *
+ * `fetch` follows redirects on its own and re-sends the headers it was given,
+ * which were resolved for the address first called. It withholds
+ * `Authorization` from another origin, and nothing else: a secret in any other
+ * header would travel to wherever the first host pointed. So redirects are
+ * followed here instead, and the headers are resolved again for each hop.
+ *
+ * A header that may not go to the next hop is left out and the request goes on
+ * without it, rather than being refused. A host that takes a token and answers
+ * with a redirect to storage — a signed URL, which must not be sent the token —
+ * is the ordinary case of a credentialed download. Once left out, a header
+ * stays out for the rest of the chain, as it does in `fetch`.
+ */
+import { SecretVault, resolveCredential } from "./secrets";
+
+/** How many redirects one request follows before it is given up. */
+const MAX_REDIRECTS = 10;
+
+const REDIRECT_STATUS = new Set([301, 302, 303, 307, 308]);
+
+/** What `fetch` itself withholds from a redirect to another origin. */
+const ORIGIN_BOUND = new Set(["authorization", "cookie", "proxy-authorization"]);
+
+/** What describes a body, and goes when a redirect drops the body. */
+const BODY_HEADERS = new Set([
+  "content-type",
+  "content-length",
+  "content-encoding",
+  "content-language",
+  "content-location",
+]);
+
+export type CredentialedRequest = {
+  method?: string;
+  /** As configured: a value may name secrets, or be a literal. */
+  headers?: Record<string, string>;
+  body?: BodyInit;
+  signal?: AbortSignal;
+};
+
+/**
+ * The response at the end of the redirects, or a sentence saying why there is
+ * none: a secret that may not be sent to the address called, a redirect to
+ * something that is not an `http(s)` address, or too many of them.
+ */
+export async function fetchWithCredentials(
+  vault: SecretVault | null | undefined,
+  url: string,
+  request: CredentialedRequest = {},
+  fetchImpl: typeof fetch = fetch,
+): Promise<{ response: Response } | { problem: string }> {
+  let current = url;
+  let method = (request.method ?? "GET").toUpperCase();
+  let body = request.body;
+  let held = { ...(request.headers ?? {}) };
+
+  for (let redirects = 0; ; redirects++) {
+    // Only the address called can have a problem: what may not go to a later
+    // hop was left out before getting here.
+    const { value: headers, problem } = resolveCredential(vault, held, current);
+    if (problem) {
+      return { problem };
+    }
+    const response = await fetchImpl(current, {
+      method,
+      headers,
+      body,
+      signal: request.signal,
+      redirect: "manual",
+    });
+    const location = REDIRECT_STATUS.has(response.status)
+      ? response.headers.get("location")
+      : null;
+    if (!location) {
+      return { response };
+    }
+    await response.body?.cancel();
+    if (redirects >= MAX_REDIRECTS) {
+      return { problem: `${url} redirected more than ${MAX_REDIRECTS} times` };
+    }
+
+    const from = new URL(current);
+    let to: URL;
+    try {
+      to = new URL(location, from);
+    } catch {
+      return { problem: `${current} redirected to ${JSON.stringify(location)}, which is not a URL` };
+    }
+    if (to.protocol !== "http:" && to.protocol !== "https:") {
+      return { problem: `${current} redirected to a ${to.protocol}// address` };
+    }
+
+    // As `fetch` does: a 303 is fetched, and so is what a POST was sent to by
+    // a 301 or 302; a 307 or 308 repeats the request as it was.
+    const becomesGet =
+      (response.status === 303 && method !== "GET" && method !== "HEAD") ||
+      ((response.status === 301 || response.status === 302) && method === "POST");
+    if (becomesGet) {
+      method = "GET";
+      body = undefined;
+    }
+
+    const crossOrigin = to.origin !== from.origin;
+    held = Object.fromEntries(
+      Object.entries(held).filter(([name, value]) => {
+        const header = name.toLowerCase();
+        if (becomesGet && BODY_HEADERS.has(header)) {
+          return false;
+        }
+        if (crossOrigin && ORIGIN_BOUND.has(header)) {
+          return false;
+        }
+        return !resolveCredential(vault, value, to.href).problem;
+      }),
+    );
+    current = to.href;
+  }
+}

package/bundle/hkp-node/src/egress.ts

@@ -0,0 +1,344 @@
+/**
+ * Where a board may make this server connect to.
+ *
+ * A board names destinations — an HTTP Client's URL, a feed, a mail server, a
+ * model's base URL — and the server dials them. On a person's own machine that
+ * is the point: a board talks to the printer, the NAS, a model on the LAN. On
+ * a server several people's boards run on it is not: a destination on the
+ * server's loopback, its private network or a cloud provider's metadata
+ * endpoint (`169.254.169.254`, which hands out the instance's credentials) is
+ * something the server can reach and the board's author should not.
+ *
+ * So a server can be told it is hosted: with `HKP_EGRESS=public`, a destination
+ * is reached only when every address its name resolves to is a public internet
+ * address. Unset, nothing is refused.
+ *
+ * **Judged where the socket opens, on the address it opens to.** Not on the
+ * name a board wrote: a name is whatever its owner points it at, and a name
+ * that resolved to a public address when it was checked may resolve to
+ * `127.0.0.1` when it is dialled. Checking at the connection covers that, every
+ * hop of a redirect, and every spelling of an address (`2130706433`, `0x7f.1`),
+ * which are addresses by then.
+ *
+ * Every `fetch` in the process goes through a dispatcher installed here, so a
+ * service written later is covered without doing anything. A service that
+ * opens its own socket — IMAP, SMTP — asks `reachableAddress` first and
+ * connects to what it answers. `tests/egress-sources.test.ts` fails on any
+ * other way out.
+ *
+ * Connections the operator configured rather than a board — the coordinator
+ * link, the token issuer's keys — are not a board's destinations and are not
+ * judged here.
+ */
+import dns from "node:dns";
+import net from "node:net";
+
+// Types only at the top: importing undici installs a dispatcher of its own as
+// the process's when none is set, and an open server is to keep the one it
+// had. It is loaded when a policy is set that needs it.
+import type { Dispatcher } from "undici";
+
+/** An address range: the address as bytes, and how many leading bits count. */
+type Range = { bytes: number[]; bits: number };
+
+export type EgressPolicy =
+  | { mode: "open" }
+  | {
+      mode: "public";
+      /** Addresses and ranges reached anyway, as the operator listed them. */
+      allow: Range[];
+    };
+
+/**
+ * What is not the public internet: this host, private networks, link-local
+ * (where the metadata endpoints are), shared address space, and what is not
+ * an address one connects to at all. `::/96` is the deprecated IPv4-compatible
+ * form (`::127.0.0.1`); `64:ff9b:1::/48` is a network's own NAT64 prefix, which
+ * may translate to private IPv4 and puts the IPv4 address where that network
+ * chose, so the whole range is refused rather than judged by what it carries.
+ */
+const NOT_PUBLIC = [
+  "0.0.0.0/8",
+  "127.0.0.0/8",
+  "10.0.0.0/8",
+  "172.16.0.0/12",
+  "192.168.0.0/16",
+  "100.64.0.0/10",
+  "169.254.0.0/16",
+  "192.0.0.0/24",
+  "198.18.0.0/15",
+  "224.0.0.0/4",
+  "240.0.0.0/4",
+  "::/96",
+  "::1/128",
+  "fe80::/10",
+  "fc00::/7",
+  "ff00::/8",
+  "64:ff9b:1::/48",
+].map(parseRange);
+
+/**
+ * IPv6 forms that carry an IPv4 address, and where it sits. An address in one
+ * of them is the IPv4 address inside it — `::ffff:127.0.0.1` is loopback — and
+ * is judged as that.
+ */
+const CARRY_IPV4: Array<{ range: Range; at: number }> = [
+  { range: parseRange("::ffff:0:0/96"), at: 12 },
+  { range: parseRange("64:ff9b::/96"), at: 12 },
+  { range: parseRange("2002::/16"), at: 2 },
+];
+
+/** An address as bytes: 4 for IPv4, 16 for IPv6. Null when it is neither. */
+function toBytes(address: string): number[] | null {
+  const plain = address.replace(/^\[|\]$/g, "").replace(/%.*$/, "");
+  const kind = net.isIP(plain);
+  if (kind === 4) {
+    return plain.split(".").map(Number);
+  }
+  if (kind !== 6) {
+    return null;
+  }
+  // A dotted IPv4 tail ("::ffff:127.0.0.1") becomes the two groups it is.
+  let text = plain;
+  const tail = /(\d+\.\d+\.\d+\.\d+)$/.exec(text);
+  if (tail) {
+    const [a, b, c, d] = tail[1].split(".").map(Number);
+    text = `${text.slice(0, tail.index)}${((a << 8) | b).toString(16)}:${((c << 8) | d).toString(16)}`;
+  }
+  const [head, rest] = text.split("::");
+  const groupsOf = (part: string | undefined) =>
+    part ? part.split(":").map((group) => parseInt(group, 16)) : [];
+  const left = groupsOf(head);
+  const right = groupsOf(rest);
+  const groups =
+    rest === undefined
+      ? left
+      : [...left, ...new Array(8 - left.length - right.length).fill(0), ...right];
+  return groups.flatMap((group) => [group >> 8, group & 0xff]);
+}
+
+function parseRange(text: string): Range {
+  const [address, bits] = text.split("/");
+  const bytes = toBytes(address);
+  if (!bytes) {
+    throw new Error(`Not an address or a range: ${text}`);
+  }
+  return { bytes, bits: bits === undefined ? bytes.length * 8 : Number(bits) };
+}
+
+function inRange(bytes: number[], range: Range): boolean {
+  if (bytes.length !== range.bytes.length) {
+    return false;
+  }
+  for (let bit = 0; bit < range.bits; bit += 1) {
+    const byte = bit >> 3;
+    const mask = 0x80 >> (bit & 7);
+    if ((bytes[byte] & mask) !== (range.bytes[byte] & mask)) {
+      return false;
+    }
+  }
+  return true;
+}
+
+/** Whether `address` is a public internet address. Not an address: false. */
+export function isPublicAddress(address: string): boolean {
+  const bytes = toBytes(address);
+  if (!bytes) {
+    return false;
+  }
+  for (const { range, at } of CARRY_IPV4) {
+    if (inRange(bytes, range)) {
+      return isPublicAddress(bytes.slice(at, at + 4).join("."));
+    }
+  }
+  return !NOT_PUBLIC.some((range) => inRange(bytes, range));
+}
+
+/**
+ * Reads `HKP_EGRESS` and `HKP_EGRESS_ALLOW`. An entry of the list that is not
+ * an address or a range is an error rather than skipped: an operator who
+ * meant to allow something should learn now that nothing was.
+ */
+export function readEgressPolicy(env: NodeJS.ProcessEnv): EgressPolicy {
+  const mode = (env.HKP_EGRESS ?? "").trim().toLowerCase();
+  if (!mode || mode === "open") {
+    return { mode: "open" };
+  }
+  if (mode !== "public") {
+    throw new Error(`HKP_EGRESS must be "public" or unset, not "${env.HKP_EGRESS}"`);
+  }
+  const allow = (env.HKP_EGRESS_ALLOW ?? "")
+    .split(",")
+    .map((entry) => entry.trim())
+    .filter(Boolean)
+    .map((entry) => {
+      try {
+        return parseRange(entry);
+      } catch {
+        throw new Error(
+          `HKP_EGRESS_ALLOW: "${entry}" is not an address or a range (names are not accepted: an allowed name could be repointed)`,
+        );
+      }
+    });
+  return { mode: "public", allow };
+}
+
+/** Whether a destination at `address` may be reached under `policy`. */
+export function mayReach(policy: EgressPolicy, address: string): boolean {
+  if (policy.mode === "open") {
+    return true;
+  }
+  const bytes = toBytes(address);
+  if (bytes && policy.allow.some((range) => inRange(bytes, range))) {
+    return true;
+  }
+  return isPublicAddress(address);
+}
+
+/** A destination this server will not connect to, and why. */
+export class EgressRefused extends Error {
+  readonly code = "EHKPEGRESS";
+
+  constructor(
+    readonly host: string,
+    readonly address: string,
+  ) {
+    super(
+      host === address
+        ? `This server does not reach private addresses (${address})`
+        : `This server does not reach private addresses (${host} is ${address})`,
+    );
+    this.name = "EgressRefused";
+  }
+}
+
+let active: EgressPolicy = { mode: "open" };
+let before: Dispatcher | null = null;
+
+export function egressPolicy(): EgressPolicy {
+  return active;
+}
+
+/**
+ * `dns.lookup`, refusing a name any of whose addresses may not be reached.
+ *
+ * All of them, not the one that would be used: a name answering with a public
+ * address and a private one is a name somebody arranged, and which of the two
+ * a connection ends up on is not this function's to promise.
+ */
+export const egressLookup = ((
+  hostname: string,
+  options: dns.LookupOptions | number | ((...args: unknown[]) => void),
+  callback?: (...args: unknown[]) => void,
+) => {
+  const done = (typeof options === "function" ? options : callback)!;
+  const asked: dns.LookupOptions =
+    typeof options === "object" ? options : typeof options === "number" ? { family: options } : {};
+  dns.lookup(hostname, { ...asked, all: true }, (err, addresses) => {
+    if (err) {
+      done(err);
+      return;
+    }
+    const refused = addresses.find(({ address }) => !mayReach(active, address));
+    if (refused) {
+      done(new EgressRefused(hostname, refused.address));
+      return;
+    }
+    if (asked.all) {
+      done(null, addresses);
+      return;
+    }
+    done(null, addresses[0].address, addresses[0].family);
+  });
+}) as typeof dns.lookup;
+
+/** Resolves `host` through `egressLookup`: every address, or the refusal. */
+function lookupAll(host: string): Promise<dns.LookupAddress[]> {
+  return new Promise((resolve, reject) => {
+    egressLookup(host, { all: true }, (err, addresses) =>
+      err ? reject(err) : resolve(addresses as unknown as dns.LookupAddress[]),
+    );
+  });
+}
+
+/**
+ * Where a service that opens its own socket should connect, for `host`.
+ *
+ * Open: `host` itself, as before. Hosted: the address the guard checked, with
+ * `host` as the name to verify the certificate against — connecting to the
+ * name instead would resolve it again, and the second answer is not the one
+ * that was judged.
+ */
+export async function reachableAddress(
+  host: string,
+): Promise<{ host: string; servername?: string }> {
+  if (active.mode === "open") {
+    return { host };
+  }
+  if (net.isIP(host.replace(/^\[|\]$/g, ""))) {
+    if (!mayReach(active, host)) {
+      throw new EgressRefused(host, host);
+    }
+    return { host };
+  }
+  const [first] = await lookupAll(host);
+  return { host: first.address, servername: host };
+}
+
+/**
+ * Makes `policy` the process's. Hosted, every `fetch` is dispatched through a
+ * connector that refuses what may not be reached; open, the dispatcher that
+ * was there before is put back.
+ *
+ * The connector judges an address literal itself: a socket opened to one is
+ * never looked up, so `egressLookup` alone would let `http://127.0.0.1/`
+ * through.
+ */
+export async function setEgressPolicy(policy: EgressPolicy): Promise<void> {
+  active = policy;
+  if (policy.mode === "open" && !before) {
+    return;
+  }
+  const { Agent, buildConnector, getGlobalDispatcher, setGlobalDispatcher } =
+    await import("undici");
+  if (policy.mode === "open") {
+    setGlobalDispatcher(before!);
+    before = null;
+    return;
+  }
+  before ??= getGlobalDispatcher();
+  const connect = buildConnector({ lookup: egressLookup });
+  setGlobalDispatcher(
+    new Agent({
+      connect: (options, callback) => {
+        const host = (options.hostname ?? "").replace(/^\[|\]$/g, "");
+        if (net.isIP(host) && !mayReach(active, host)) {
+          callback(new EgressRefused(host, host), null);
+          return;
+        }
+        connect(options, callback);
+      },
+    }),
+  );
+}
+
+/**
+ * What to say about a failed request: the refusal when this was one. `fetch`
+ * reports every connection failure as "fetch failed" and keeps the reason as
+ * its cause.
+ */
+export function failureReason(err: unknown): string {
+  return refusalIn(err)?.message ?? (err instanceof Error ? err.message : String(err));
+}
+
+/** The refusal an error is, or was caused by. */
+export function refusalIn(err: unknown): EgressRefused | null {
+  let current: unknown = err;
+  for (let depth = 0; current && depth < 5; depth += 1) {
+    if (current instanceof EgressRefused) {
+      return current;
+    }
+    current = (current as { cause?: unknown }).cause;
+  }
+  return null;
+}

package/bundle/hkp-node/src/expressionEval.ts

@@ -0,0 +1,223 @@
+/**
+ * The expressions a board writes — a Map's terms, a Filter's predicate — and
+ * what evaluating one may reach.
+ *
+ * This is the boundary between a board, which somebody else may have written,
+ * and the process it runs in: on a hosted server, everyone the server lets in.
+ * It was the `expression-eval` package until its author stopped maintaining
+ * it; it is kept here so that it is read and changed like the security code it
+ * is (`docs/content/concepts/runtime.md`). Parsing is `jsep`'s, pinned.
+ *
+ * What an expression can do is what the scope it is given can do, and nothing
+ * else:
+ *
+ * - **No way to code.** Nothing here compiles a string, and the routes to
+ *   something that does — `constructor`, `prototype`, `__proto__`, and every
+ *   other `__`-prefixed member — are refused by name, however the name is
+ *   arrived at (`a.b`, `a["b"]`, `a[["b"]]`).
+ * - **No assignment.** The grammar has none, so an expression reads and calls
+ *   but never writes a property.
+ * - **Only the scope.** A name resolves to the scope's own property or to
+ *   nothing; what the scope inherits from `Object.prototype` is not a name.
+ *
+ * A member of nothing is nothing: `params.a.b` with no `a` is `undefined`, read
+ * as `params.a?.b` would be, rather than an error — the way hkp-rt and
+ * hkp-python read it, so a term evaluates alike wherever it runs. Whoever wants
+ * to know which reads came up empty passes `onMissing`.
+ *
+ * Twin of `hkp-frontend/src/runtime/browser/services/base/expressionEval.ts`;
+ * the two are kept identical, so a term evaluates alike in either runtime.
+ */
+import jsep from "jsep";
+
+export type Expression = jsep.Expression;
+
+type Scope = Record<string, unknown>;
+
+/**
+ * Told the path of a read that found nothing — `params.titel` — once per
+ * chain: in `params.a.b.c` with no `a`, only `params.a` is reported.
+ */
+export type OnMissing = (path: string) => void;
+
+const BINARY: Record<string, (a: any, b: any) => unknown> = {
+  "|": (a, b) => a | b,
+  "^": (a, b) => a ^ b,
+  "&": (a, b) => a & b,
+  "==": (a, b) => a == b, // eslint-disable-line eqeqeq
+  "!=": (a, b) => a != b, // eslint-disable-line eqeqeq
+  "===": (a, b) => a === b,
+  "!==": (a, b) => a !== b,
+  "<": (a, b) => a < b,
+  ">": (a, b) => a > b,
+  "<=": (a, b) => a <= b,
+  ">=": (a, b) => a >= b,
+  "<<": (a, b) => a << b,
+  ">>": (a, b) => a >> b,
+  ">>>": (a, b) => a >>> b,
+  "+": (a, b) => a + b,
+  "-": (a, b) => a - b,
+  "*": (a, b) => a * b,
+  "/": (a, b) => a / b,
+  "%": (a, b) => a % b,
+};
+
+const UNARY: Record<string, (a: any) => unknown> = {
+  "-": (a) => -a,
+  "+": (a) => +a,
+  "~": (a) => ~a,
+  "!": (a) => !a,
+};
+
+/** Members that lead from a value to the code behind it. */
+const REFUSED_MEMBERS = new Set(["constructor", "prototype"]);
+
+/** Parses an expression; throws on one that does not parse. */
+export function parse(source: string): Expression {
+  return jsep(source);
+}
+
+/** The member a key names, or a refusal when it names a way out. */
+function memberKey(key: unknown): string | number {
+  if (typeof key === "number") {
+    return key;
+  }
+  // As a property access would read it: `a[["b"]]` is `a.b`.
+  const name = String(key);
+  if (REFUSED_MEMBERS.has(name) || name.startsWith("__")) {
+    throw new Error(`Access to member "${name}" disallowed.`);
+  }
+  return name;
+}
+
+/** How a read is named when it is reported: `params.items[0].title`. */
+function pathOf(node: Expression): string {
+  switch (node.type) {
+    case "Identifier":
+      return (node as jsep.Identifier).name;
+    case "ThisExpression":
+      return "this";
+    case "MemberExpression": {
+      const read = node as jsep.MemberExpression;
+      const object = pathOf(read.object);
+      if (!read.computed) {
+        return `${object}.${(read.property as jsep.Identifier).name}`;
+      }
+      return read.property.type === "Literal"
+        ? `${object}[${JSON.stringify((read.property as jsep.Literal).value)}]`
+        : `${object}[…]`;
+    }
+    default:
+      return "…";
+  }
+}
+
+function member(
+  node: jsep.MemberExpression,
+  scope: Scope,
+  onMissing?: OnMissing,
+): [unknown, unknown] {
+  const object = evaluate(node.object, scope, onMissing) as any;
+  const key = memberKey(
+    node.computed
+      ? evaluate(node.property, scope, onMissing)
+      : (node.property as jsep.Identifier).name,
+  );
+  const nothing = object === undefined || object === null;
+  const value = nothing ? undefined : object[key];
+  // A read past a link that came up empty was reported with it; one past a
+  // link that is there but null is reported itself.
+  const pastMissing =
+    object === undefined && node.object.type === "MemberExpression";
+  if (value === undefined && onMissing && !pastMissing) {
+    onMissing(pathOf(node));
+  }
+  return [object, value];
+}
+
+/**
+ * Evaluates a parsed expression with `scope` as everything it may name;
+ * `onMissing` hears about every read that found nothing.
+ */
+export function evaluate(
+  node: Expression,
+  scope: Scope,
+  onMissing?: OnMissing,
+): unknown {
+  switch (node.type) {
+    case "ArrayExpression":
+      return (node as jsep.ArrayExpression).elements.map((element) =>
+        evaluate(element, scope, onMissing),
+      );
+    case "BinaryExpression": {
+      const binary = node as jsep.BinaryExpression;
+      const operator = BINARY[binary.operator];
+      if (!operator) {
+        throw new Error(`Unsupported operator "${binary.operator}"`);
+      }
+      return operator(
+        evaluate(binary.left, scope, onMissing),
+        evaluate(binary.right, scope, onMissing),
+      );
+    }
+    case "LogicalExpression": {
+      const logical = node as jsep.LogicalExpression;
+      if (logical.operator === "||") {
+        return (
+          evaluate(logical.left, scope, onMissing) ||
+          evaluate(logical.right, scope, onMissing)
+        );
+      }
+      if (logical.operator === "&&") {
+        return (
+          evaluate(logical.left, scope, onMissing) &&
+          evaluate(logical.right, scope, onMissing)
+        );
+      }
+      throw new Error(`Unsupported operator "${logical.operator}"`);
+    }
+    case "CallExpression": {
+      const call = node as jsep.CallExpression;
+      let self: unknown;
+      let fn: unknown;
+      if (call.callee.type === "MemberExpression") {
+        [self, fn] = member(call.callee as jsep.MemberExpression, scope, onMissing);
+      } else {
+        fn = evaluate(call.callee, scope, onMissing);
+      }
+      if (typeof fn !== "function") {
+        throw new TypeError(`${pathOf(call.callee)} is not a function`);
+      }
+      return fn.apply(
+        self,
+        call.arguments.map((argument) => evaluate(argument, scope, onMissing)),
+      );
+    }
+    case "ConditionalExpression": {
+      const conditional = node as jsep.ConditionalExpression;
+      return evaluate(conditional.test, scope, onMissing)
+        ? evaluate(conditional.consequent, scope, onMissing)
+        : evaluate(conditional.alternate, scope, onMissing);
+    }
+    case "Identifier": {
+      const name = (node as jsep.Identifier).name;
+      return Object.prototype.hasOwnProperty.call(scope, name) ? scope[name] : undefined;
+    }
+    case "Literal":
+      return (node as jsep.Literal).value;
+    case "MemberExpression":
+      return member(node as jsep.MemberExpression, scope, onMissing)[1];
+    case "ThisExpression":
+      return scope;
+    case "UnaryExpression": {
+      const unary = node as jsep.UnaryExpression;
+      const operator = UNARY[unary.operator];
+      if (!operator) {
+        throw new Error(`Unsupported operator "${unary.operator}"`);
+      }
+      return operator(evaluate(unary.argument, scope, onMissing));
+    }
+    default:
+      return undefined;
+  }
+}