@zvndev/darkmown 2.0.0 → 2.1.0

package/site/pages/playground/index.skin

@@ -0,0 +1,128 @@
+tokens
+  pgink #eef2e6
+  pgbg #10160c
+  pgpanel #18210f
+  pgline #2c3a20
+  pgaccent #8fd694
+  pgmuted #9db089
+  pgradius 10px
+
+page
+  margin 0
+  font system-ui, -apple-system, "Segoe UI", Roboto, sans-serif
+  color $pgink
+  bg $pgbg
+  line-height 1.6
+
+main
+  max-width 1100px
+  margin 0 auto
+  padding 2.5rem 1.5rem 4rem
+
+.pg-intro h1
+  font-size 2.6rem
+  line-height 1.05
+  margin 0 0 .6rem
+  color $pgink
+
+.pg-intro p
+  color $pgmuted
+  max-width 46rem
+
+.pg-intro a
+  color $pgaccent
+
+.pg-picker
+  display flex
+  flex-wrap wrap
+  gap .5rem
+  margin 1.4rem 0 1rem
+
+.pg-picker button
+  font inherit
+  font-size .92rem
+  font-weight 560
+  padding .5rem 1rem
+  color $pgink
+  bg $pgpanel
+  border 1px solid $pgline
+  radius 999px
+  cursor pointer
+  transition background .14s ease, border-color .14s ease, transform .14s ease
+
+.pg-picker button:hover
+  border-color $pgaccent
+  transform translateY(-1px)
+
+.pg-picker button:focus-visible
+  outline 2px solid $pgaccent
+  outline-offset 2px
+
+.pg-workbench
+  display grid
+  grid-template-columns 1fr 1fr
+  gap 1rem
+  margin-top 1.5rem
+  align-items stretch
+
+.pg-pane
+  display flex
+  flex-direction column
+  min-width 0
+
+.pg-label
+  font-size .78rem
+  font-weight 600
+  letter-spacing .04em
+  text-transform uppercase
+  color $pgmuted
+  margin-bottom .5rem
+
+.pg-editor
+  width 100%
+  min-height 30rem
+  flex 1
+  resize vertical
+  padding 1rem 1.1rem
+  color $pgink
+  bg $pgpanel
+  border 1px solid $pgline
+  radius $pgradius
+  font ui-monospace, "SF Mono", Menlo, Consolas, monospace
+  font-size .9rem
+  line-height 1.55
+  tab-size 2
+
+.pg-editor:focus-visible
+  outline none
+  border-color $pgaccent
+  box-shadow 0 0 0 3px rgba(143,214,148,.16)
+
+.pg-preview
+  width 100%
+  min-height 30rem
+  flex 1
+  border 1px solid $pgline
+  radius $pgradius
+  bg #12190f
+
+.pg-error
+  margin .75rem 0 0
+  padding .9rem 1.1rem
+  color #ffd9d0
+  bg #2a1712
+  border 1px solid #6b2c1e
+  radius $pgradius
+  font ui-monospace, "SF Mono", Menlo, Consolas, monospace
+  font-size .82rem
+  line-height 1.5
+  white-space pre-wrap
+  word-break break-word
+
+@media (max-width: 820px)
+  .pg-workbench
+    grid-template-columns 1fr
+  .pg-editor
+    min-height 18rem
+  .pg-preview
+    min-height 22rem

package/site/pages/playground/index.wd

@@ -0,0 +1,51 @@
+---
+title: Playground — run Markdown in your browser
+description: Edit a .wd file and watch it compile and run in your browser — the same compiler the Darkmown CLI uses, no install required.
+html: true
+transitions: true
+---
+
+@include /nav.wd
+
+<main>
+
+:state activeExample = "store"
+
+::: section .pg-intro
+
+# Playground
+
+Edit the Markdown on the left. It compiles **in your browser** — the exact same
+compiler the CLI ships — and runs live on the right. No install, no build step.
+
+::: div .pg-picker
+:button "Store + cart" -> activeExample = "store"
+:button "Counter" -> activeExample = "counter"
+:button "Plain Markdown" -> activeExample = "markdown"
+:::
+
+Now editing the **{ activeExample }** example. Change any text and the preview
+re-renders as you type. Break the syntax on purpose — the real compiler error,
+with `file:line` and a fix hint, shows up in the preview pane.
+
+:::
+
+::: section .pg-workbench
+
+::: div .pg-pane .pg-pane-source
+<label class="pg-label" for="pg-editor">Source</label>
+
+<textarea id="pg-editor" class="pg-editor" spellcheck="false" autocapitalize="off" autocomplete="off" aria-label="Markdown source"></textarea>
+:::
+
+::: div .pg-pane .pg-pane-preview
+<label class="pg-label" for="pg-preview">Preview</label>
+
+<iframe id="pg-preview" class="pg-preview" title="Live preview" sandbox="allow-scripts allow-same-origin"></iframe>
+
+<pre id="pg-error" class="pg-error" role="alert" hidden></pre>
+:::
+
+:::
+
+</main>

package/site/pages/showcase/index.wd

@@ -96,7 +96,7 @@ Darkmown's whole pitch is weight. A static page ships **zero** framework JavaScr
 
 ::: card .sc-scale
 - **Static Darkmown page** — `0 KB` framework JS. Forever.
-- **Reactive Darkmown page** — one shared `~7.4 KB` gzipped runtime, no per-component bundles.
+- **Reactive Darkmown page** — one shared `~7.7 KB` gzipped runtime, no per-component bundles.
 - **A typical SPA** — ships a framework runtime in the **~15–60 KB** gzipped range *before* your app code, on every page (Alpine ~15 KB, Vue ~18 KB runtime, React 19 ~59 KB).
 :::
 

package/src/builder.js

@@ -352,9 +352,11 @@ function buildRoute(route, cwd, paths, collections, feedLink, warned) {
  * incremental builds keeps them consistent by construction.
  *
  * Cloudflare Pages reads dist/_headers for security headers (Vercel reads
- * vercel.json; the local server adds them in src/statics.js). Static routes get
- * the stricter CSP (no 'unsafe-eval'); reactive routes get the relaxed one. A
- * catch-all keeps assets and any future path covered.
+ * vercel.json; the local server adds them in src/statics.js). Since 2.1 both CSP
+ * variants are eval-free (the reactive runtime walks a validated AST, not
+ * `new Function`), so static and reactive routes resolve to the same policy; the
+ * per-route static override is kept as defense-in-depth. A catch-all keeps assets
+ * and any future path covered.
  * @param {RouteManifestEntry[]} manifest
  * @param {Paths} paths
  * @returns {void}
@@ -924,10 +926,10 @@ export function stripRuntimeComments(source) {
  *
  * Cloudflare applies every matching block in order; when blocks set the same
  * header, the later block wins. So we emit the catch-all `/*` first (baseline
- * security headers + the relaxed reactive CSP that satisfies every page), then
- * one block per static route that overrides `Content-Security-Policy` with the
- * stricter, eval-free CSP. Reactive routes need no override — the catch-all
- * already carries the relaxed CSP.
+ * security headers + the reactive CSP, which since 2.1 is eval-free and satisfies
+ * every page), then one block per static route that re-states the same eval-free
+ * CSP as defense-in-depth. Reactive routes need no override — the catch-all
+ * already carries the eval-free CSP.
  *
  * Clean URLs mean a route like `/docs/` is served at both `/docs` and `/docs/`,
  * so each static route emits a path glob (`/docs`, `/docs/*`) that covers both.
@@ -941,7 +943,7 @@ export function renderCloudflareHeaders(manifest) {
   const blocks = [["/*", [...baseLines, `  Content-Security-Policy: ${REACTIVE_CSP}`]]];
 
   for (const entry of manifest) {
-    if (entry.assets.runtime) continue; // reactive routes keep the catch-all (relaxed) CSP
+    if (entry.assets.runtime) continue; // reactive routes keep the catch-all (eval-free) CSP
     for (const pattern of cloudflarePathPatterns(entry.route)) {
       blocks.push([pattern, [`  Content-Security-Policy: ${STATIC_CSP}`]]);
     }

package/src/compiler/collections.js

@@ -15,10 +15,10 @@
 // `scoped`/`draft`).
 // ---------------------------------------------------------------------------
 
-import fs from "node:fs";
 import path from "node:path";
 import { firstParagraph } from "../feeds.js";
 import { parseFrontmatter } from "./frontmatter.js";
+import { fsReader } from "./fs-reader.js";
 
 /**
  * @typedef {import("./context.js").Paths} Paths
@@ -47,20 +47,22 @@ const SCHEMA_TYPES = new Set(["string", "number", "boolean", "date", "string[]"]
  *
  * @param {Route[]} routes Post-draft-filter routes from `discoverRoutes`.
  * @param {Paths} paths Resolved project paths (`routesRoot` for `_schema.wd`).
+ * @param {import("./reader.js").Reader} [reader] Source reader (fs-backed by
+ *   default; pass an in-memory reader to build collections without a filesystem).
  * @returns {Map<string, CollectionRow[]>} Collection name → entry rows.
  */
-export function buildCollections(routes, paths) {
+export function buildCollections(routes, paths, reader = fsReader()) {
   /** @type {Map<string, CollectionRow[]>} */
   const collections = new Map();
   for (const route of routes) {
     const name = collectionNameOf(route.route);
     if (!name) continue;
     const rows = collections.get(name) || [];
-    rows.push(rowFor(route));
+    rows.push(rowFor(route, reader));
     collections.set(name, rows);
   }
   for (const [name, rows] of collections) {
-    const schema = readSchema(name, paths);
+    const schema = readSchema(name, paths, reader);
     if (schema) validateRows(rows, schema, name);
   }
   return collections;
@@ -87,9 +89,10 @@ function collectionNameOf(route) {
  * are added AFTER the spread so a stray frontmatter `url:`/`slug:` can't shadow
  * the real route data the loop relies on.
  * @param {Route} route
+ * @param {import("./reader.js").Reader} reader Source reader for the excerpt body.
  * @returns {CollectionRow}
  */
-function rowFor(route) {
+function rowFor(route, reader) {
   const slug = path.basename(route.file, path.extname(route.file));
   /** @type {Record<string, unknown>} */
   const fields = {};
@@ -98,7 +101,7 @@ function rowFor(route) {
     ...fields,
     url: route.route,
     slug: slug === "index" ? path.basename(path.dirname(route.file)) : slug,
-    excerpt: excerptFor(route)
+    excerpt: excerptFor(route, reader)
   };
 }
 
@@ -126,13 +129,14 @@ function coerceScalar(value) {
  * (plain `.md` only) the first paragraph of its body, else "". Mirrors the RSS
  * description fallback so a collection card and the feed read the same snippet.
  * @param {Route} route
+ * @param {import("./reader.js").Reader} reader Source reader for the `.md` body.
  * @returns {string}
  */
-function excerptFor(route) {
+function excerptFor(route, reader) {
   const fromMeta = route.meta.excerpt;
   if (typeof fromMeta === "string" && fromMeta.trim()) return fromMeta.trim();
   if (path.extname(route.file) !== ".md") return "";
-  const { body } = parseFrontmatter(fs.readFileSync(route.file, "utf8"), route.file);
+  const { body } = parseFrontmatter(reader.readText(route.file), route.file);
   return firstParagraph(body);
 }
 
@@ -153,12 +157,13 @@ function excerptFor(route) {
  * schema file itself, pointing at the offending line.
  * @param {string} name Collection name.
  * @param {Paths} paths
+ * @param {import("./reader.js").Reader} [reader] Source reader (fs-backed by default).
  * @returns {SchemaField[] | null}
  */
-export function readSchema(name, paths) {
+export function readSchema(name, paths, reader = fsReader()) {
   const file = path.join(paths.routesRoot, name, "_schema.wd");
-  if (!fs.existsSync(file)) return null;
-  const raw = fs.readFileSync(file, "utf8");
+  if (!reader.exists(file)) return null;
+  const raw = reader.readText(file);
   return parseSchema(raw, file);
 }
 

package/src/compiler/context.js

@@ -77,6 +77,10 @@
  *   dependency map that drives incremental rebuilds.
  * @property {Set<string>} collectionsUsed Names of the collections this compile
  *   looped, so a change to any entry of a collection rebuilds its consumers.
+ * @property {import("./reader.js").Reader} reader The file reader every source
+ *   read threads through — the real filesystem by default, or an in-memory map
+ *   for `compileFromMemory`. Set once by `createCompilation` and reached via
+ *   `ctx.comp.reader` in the directive handlers (includes, loop data).
  */
 
 /**
@@ -102,15 +106,24 @@
  * @property {string[]} sections Active section-id scope chain.
  * @property {string | null} loopItem Name of the current reactive loop item, if any.
  * @property {string} [loopKey] State key of the list being looped, if any.
+ * @property {number} [reactiveDepth] Number of enclosing REACTIVE `@loop` levels
+ *   (0 at top level). The runtime reconciles at most two nested `data-wd-loop`
+ *   levels — a third paints empty — so a third reactive level is rejected at
+ *   compile time. Static (build-unrolled) loops flatten to markup and don't add
+ *   a level, so they carry the count through without incrementing it.
+ * @property {{ at: string, line: string }} [loopOpener] The current `@loop`
+ *   opener's `file:line` + raw text, set when descending into a loop body so the
+ *   reactive-nesting-depth error can point at the offending opener.
  * @property {boolean} [loopMeta] Inside a loop body, so `$index`/`$first`/… are valid.
  * @property {import("markdown-it").default} [md] Markdown-it instance selected for this file.
  * @property {(lines: string[], ctx: Ctx) => string} compileBody The body
  *   dispatcher, threaded through the context so block handlers (`:if`, `:::`,
  *   `:form`, `@loop`, …) recurse into nested bodies without importing the
  *   dispatcher back — the module graph stays an import-cycle-free DAG.
- * @property {(file: string, context: Paths, stack: string[], scope: Scope, comp: Compilation, sections: string[], loopItem: string | null) => { meta: Meta, html: string }} compileFile
+ * @property {(file: string, context: Paths, stack: string[], scope: Scope, comp: Compilation, sections: string[], loopItem: string | null, reactiveDepth?: number, loopOpener?: { at: string, line: string } | null) => { meta: Meta, html: string }} compileFile
  *   The per-file compile, threaded for the same reason so `@include` can
- *   compile its target file.
+ *   compile its target file. `reactiveDepth`/`loopOpener` carry the enclosing
+ *   reactive-loop nesting across the include boundary so the depth guard holds.
  */
 
 /**
@@ -193,9 +206,14 @@ export const LOOP_META = {
   $count: "count"
 };
 
-/** @returns {Compilation} */
-export function createCompilation() {
+/**
+ * @param {import("./reader.js").Reader} reader The source reader for this
+ *   compile (fs-backed by default; in-memory for `compileFromMemory`).
+ * @returns {Compilation}
+ */
+export function createCompilation(reader) {
   return {
+    reader,
     assets: {
       skins: new Set(),
       scripts: new Set(),

package/src/compiler/expr-ast.js

@@ -0,0 +1,296 @@
+// ---------------------------------------------------------------------------
+// Compiled-expression → compact AST.
+//
+// The predicate/computed compilers in `predicates.js` still do ALL the security
+// validation — they map every operand through a fixed grammar to safe JS over the
+// `I()`/`S()`/`C()`/`A()` readers, and reject anything outside the whitelist. This
+// module takes that ALREADY-VALIDATED JS fragment and re-parses it into a compact
+// serialized AST (nested arrays), so the runtime can WALK it with a tiny closed
+// evaluator instead of constructing a `new Function`. That is the whole point:
+// reactive pages no longer need `script-src 'unsafe-eval'`.
+//
+// The parsed sub-language is closed and small: the reader calls `S(k[,r])`,
+// `I(p)`, `C(a,b)`, `A(name,list[,field])`; number / JSON-string / boolean / null
+// / object / array literals; the operators `! - * / % + - < > <= >= == != && ||`;
+// and grouping parens. Precedence and associativity match JavaScript exactly, so
+// the walked AST evaluates identically to the prior `new Function` path. Anything
+// unexpected is a hard parse error — never a silent fallthrough.
+//
+// Node shapes (array with a tag at [0]):
+//   ["L", value]            literal (number | string | boolean | null | obj | arr)
+//   ["S", key]              state read           → getPath(state[key])
+//   ["S", key, rest]        dotted state read    → getPath(state[key], rest)
+//   ["I", path]             loop-item read       → getPath(item, path)
+//   ["C", a, b]             contains(a, b)
+//   ["A", name, list]       aggregate            → AGG(name, list)
+//   ["A", name, list, fld]  aggregate w/ field   → AGG(name, list, fld)
+//   ["!", a] | ["u-", a]    unary not / negate
+//   [op, a, b]              binary op (op ∈ the operator set above)
+// ---------------------------------------------------------------------------
+
+import { FORMATTERS } from "./format.js";
+import { getPath } from "./interpolation.js";
+
+// Binary-operator precedence (higher binds tighter), matching JS.
+/** @type {Record<string, number>} */
+const PREC = {
+  "||": 1,
+  "&&": 2,
+  "==": 3,
+  "!=": 3,
+  "<": 4,
+  ">": 4,
+  "<=": 4,
+  ">=": 4,
+  "+": 5,
+  "-": 5,
+  "*": 6,
+  "/": 6,
+  "%": 6
+};
+
+/**
+ * Re-parse a validated compiled expression (JS fragment over I()/S()/C()/A())
+ * into a compact AST. Throws on anything outside the closed grammar.
+ * @param {string} code
+ * @returns {any[]}
+ */
+export function astOf(code) {
+  let i = 0;
+  const n = code.length;
+  const ws = () => {
+    while (i < n && /\s/.test(code[i])) i++;
+  };
+  /** Peek a binary operator at the cursor without consuming; null if none. */
+  const peekOp = () => {
+    ws();
+    const two = code.slice(i, i + 2);
+    if (
+      two === "&&" ||
+      two === "||" ||
+      two === "==" ||
+      two === "!=" ||
+      two === "<=" ||
+      two === ">="
+    )
+      return two;
+    const one = code[i];
+    if (
+      one === "<" ||
+      one === ">" ||
+      one === "+" ||
+      one === "-" ||
+      one === "*" ||
+      one === "/" ||
+      one === "%"
+    )
+      return one;
+    return null;
+  };
+  /** @param {number} minPrec @returns {any[]} */
+  const parseExpr = (minPrec) => {
+    /** @type {any[]} */
+    let left = parseUnary();
+    for (;;) {
+      const op = peekOp();
+      if (op === null) break;
+      const prec = PREC[op];
+      if (prec < minPrec) break;
+      i += op.length;
+      const right = parseExpr(prec + 1);
+      left = [op, left, right];
+    }
+    return left;
+  };
+  /** @returns {any[]} */
+  const parseUnary = () => {
+    ws();
+    if (code[i] === "!" && code[i + 1] !== "=") {
+      i++;
+      return ["!", parseUnary()];
+    }
+    if (code[i] === "-") {
+      i++;
+      return ["u-", parseUnary()];
+    }
+    return parsePrimary();
+  };
+  /** @returns {any[]} */
+  const parsePrimary = () => {
+    ws();
+    const c = code[i];
+    if (c === "(") {
+      i++;
+      /** @type {any[]} */
+      const e = parseExpr(1);
+      ws();
+      if (code[i] !== ")") throw new Error(`expr-ast: expected ) at ${i} in ${code}`);
+      i++;
+      return e;
+    }
+    if (c === '"') return ["L", readString()];
+    if (c === "{" || c === "[") return ["L", readJson()];
+    if (c === "." || (c >= "0" && c <= "9")) return ["L", readNumber()];
+    if (/[A-Za-z_$]/.test(c)) return readIdent();
+    throw new Error(`expr-ast: unexpected "${c ?? "<end>"}" at ${i} in ${code}`);
+  };
+  const readString = () => {
+    let j = i + 1;
+    while (j < n) {
+      if (code[j] === "\\") j += 2;
+      else if (code[j] === '"') break;
+      else j++;
+    }
+    const lit = code.slice(i, j + 1);
+    i = j + 1;
+    return JSON.parse(lit);
+  };
+  const readJson = () => {
+    let depth = 0;
+    let j = i;
+    for (; j < n; j++) {
+      const ch = code[j];
+      if (ch === '"') {
+        j++;
+        while (j < n && code[j] !== '"') j += code[j] === "\\" ? 2 : 1;
+      } else if (ch === "{" || ch === "[") depth++;
+      else if (ch === "}" || ch === "]") {
+        depth--;
+        if (depth === 0) {
+          j++;
+          break;
+        }
+      }
+    }
+    const lit = code.slice(i, j);
+    i = j;
+    return JSON.parse(lit);
+  };
+  const readNumber = () => {
+    let j = i;
+    while (j < n && /[0-9.]/.test(code[j])) j++;
+    const num = Number(code.slice(i, j));
+    i = j;
+    return num;
+  };
+  /** @returns {any[]} */
+  const readIdent = () => {
+    let j = i;
+    while (j < n && /[\w$]/.test(code[j])) j++;
+    const word = code.slice(i, j);
+    i = j;
+    if (word === "true") return ["L", true];
+    if (word === "false") return ["L", false];
+    if (word === "null") return ["L", null];
+    if (code[i] !== "(") throw new Error(`expr-ast: unexpected identifier "${word}" in ${code}`);
+    const args = parseArgs();
+    if (word === "S") return args.length > 1 ? ["S", args[0][1], args[1][1]] : ["S", args[0][1]];
+    if (word === "I") return ["I", args[0][1]];
+    if (word === "C") return ["C", args[0], args[1]];
+    if (word === "A")
+      return args.length > 2 ? ["A", args[0][1], args[1], args[2][1]] : ["A", args[0][1], args[1]];
+    throw new Error(`expr-ast: unknown call "${word}" in ${code}`);
+  };
+  /** @returns {any[][]} */
+  const parseArgs = () => {
+    i++; // consume "("
+    /** @type {any[][]} */
+    const args = [];
+    ws();
+    if (code[i] !== ")") {
+      args.push(parseExpr(1));
+      ws();
+      while (code[i] === ",") {
+        i++;
+        args.push(parseExpr(1));
+        ws();
+      }
+    }
+    ws();
+    if (code[i] !== ")") throw new Error(`expr-ast: expected ) closing call in ${code}`);
+    i++;
+    return args;
+  };
+
+  const ast = parseExpr(1);
+  ws();
+  if (i !== n) throw new Error(`expr-ast: trailing input at ${i} in ${code}`);
+  return ast;
+}
+
+/**
+ * `JSON.stringify(astOf(code))` — the attribute payload the runtime reads.
+ * @param {string} code
+ * @returns {string}
+ */
+export const serializeExpr = (code) => JSON.stringify(astOf(code));
+
+/** @param {unknown} a @param {unknown} b @returns {boolean} */
+const contains = (a, b) =>
+  String(a ?? "")
+    .toLowerCase()
+    .includes(String(b ?? "").toLowerCase());
+
+/**
+ * Build-time mirror of the runtime AST walker — same operators, so a `:computed`
+ * or `where`/`when` predicate folds to the SAME value the runtime will recompute.
+ * `state` reads come from the compilation's declared-state map. No eval.
+ * @param {any[]} node
+ * @param {unknown} item Loop row for I(); undefined otherwise.
+ * @param {{ state: Map<string, unknown> }} comp
+ * @returns {any}
+ */
+export function evalAst(node, item, comp) {
+  /** @param {any[]} n @returns {any} */
+  const ev = (n) => {
+    const t = n[0];
+    switch (t) {
+      case "L":
+        return n[1];
+      case "S":
+        return getPath(comp.state.get(n[1]), n[2] ? n[2].split(".") : []);
+      case "I":
+        return getPath(item, n[1] ? n[1].split(".") : []);
+      case "C":
+        return contains(ev(n[1]), ev(n[2]));
+      case "A": {
+        const f = FORMATTERS[n[1]];
+        return f ? f(ev(n[2]), n[3] == null ? [] : [n[3]]) : undefined;
+      }
+      case "!":
+        return !ev(n[1]);
+      case "u-":
+        return -ev(n[1]);
+      case "&&":
+        return ev(n[1]) && ev(n[2]);
+      case "||":
+        return ev(n[1]) || ev(n[2]);
+      case "==":
+        // biome-ignore lint/suspicious/noDoubleEquals: loose equality preserves prior `new Function` semantics exactly.
+        return ev(n[1]) == ev(n[2]);
+      case "!=":
+        // biome-ignore lint/suspicious/noDoubleEquals: loose inequality preserves prior `new Function` semantics exactly.
+        return ev(n[1]) != ev(n[2]);
+      case "<":
+        return ev(n[1]) < ev(n[2]);
+      case ">":
+        return ev(n[1]) > ev(n[2]);
+      case "<=":
+        return ev(n[1]) <= ev(n[2]);
+      case ">=":
+        return ev(n[1]) >= ev(n[2]);
+      case "+":
+        return ev(n[1]) + ev(n[2]);
+      case "-":
+        return ev(n[1]) - ev(n[2]);
+      case "*":
+        return ev(n[1]) * ev(n[2]);
+      case "/":
+        return ev(n[1]) / ev(n[2]);
+      case "%":
+        return ev(n[1]) % ev(n[2]);
+    }
+    throw new Error(`expr-ast: unknown op "${t}"`);
+  };
+  return ev(node);
+}