opensquid 0.5.395

package/dist/runtime/evaluator/expression/index.js

@@ -0,0 +1,144 @@
+/**
+ * Public `evalCondition` entry — Task H.1.6 (integration cutover).
+ *
+ * Threads the H.1.1–H.1.5 substrate (lexer → parser → AST visitor →
+ * interpreter, with an LRU parse cache) into a single boolean-returning
+ * function that the wider runtime can call as a drop-in replacement for the
+ * old 5-regex `evalCondition` in `evaluator.ts`. All five regex constants
+ * (`EQ_PATTERN`, `BARE_PATTERN`, `NUM_CMP_PATTERN`, `BOOL_CMP_PATTERN`,
+ * `STR_PATH_EQ_PATTERN`) and the `resolveNumericPath` helper are deleted
+ * upstream — the chevrotain grammar covers every form they recognised, plus
+ * the new forms (`||`, `!`, parens, deeper paths, index access, function
+ * calls) that the regex set was unable to express.
+ *
+ * Locked decisions codified here (pre-research §12, this is the cutover
+ * commit that ships them):
+ *
+ *   - §12.2 — empty `if:` returns `true` (was silent `false` + warn). Treat
+ *     a present-but-empty predicate as equivalent to "no `if:` field" so
+ *     pack-author trailing-whitespace YAML doesn't accidentally skip steps.
+ *   - §12.3 — comparison is STRICT equality. `1 == "1"` is `false`. No
+ *     `String()` wrapping. The interpreter's `applyCompare` already enforces
+ *     this; `evalCondition` does not re-coerce.
+ *   - §12.4 — `phases != "complete"` (and any other `!=` form) is now valid
+ *     grammar. The `phase-logged-before-commit` workflow rule that was a
+ *     silent no-op for the entire G-track lifetime starts firing for real.
+ *   - The 5-regex grammar is replaced wholesale; this module is the only
+ *     `if:`-parsing surface in the runtime.
+ *
+ * Error model (3 tiers, all fail-closed → `false` + `console.warn`):
+ *
+ *   1. Lex error — input has a character the lexer doesn't recognise
+ *      (e.g. `'== ='` — `=` alone is not a valid token; only `EqEq`/`NotEq`
+ *      consume `==`/`===`/`!=`/`!==`).
+ *   2. Parse error — token stream doesn't match the grammar (e.g. `'a &&'`,
+ *      `'(a || b'`).
+ *   3. Interpreter error — `InterpreterLimitError` (depth>64 or steps>10k)
+ *      or `InterpreterRuntimeError` (unknown function name).
+ *
+ * The 3-tier model means `console.warn` always names the originating layer,
+ * which makes "why did my `if:` silently skip?" diagnosable in one read.
+ *
+ * Parse cache integration: cache key = trimmed input string; cache value =
+ * the cstToAst result. Cache miss runs lex+parse+ast; cache hit jumps
+ * straight to evaluate. Setting on miss is critical — the spec's code shape
+ * shows `getCached(trimmed) ?? parse(trimmed)` but omits the `setCached`,
+ * which is a one-line bug that would make every call a cache miss.
+ *
+ * `parseExpression()` is the parse-only sibling export, exposed for H.2's
+ * Zod refinement on the `if:` schema field. It throws on any of the 3 error
+ * tiers (caller wraps in try/catch and surfaces via Zod's refinement
+ * message). The empty-string case is also a throw here — load-time
+ * validation has already established that the field is present; an empty
+ * predicate at load-time is a YAML authoring mistake worth surfacing, even
+ * though runtime semantics treat it as `true`.
+ *
+ * Imports from: `./lexer.js`, `./parser.js`, `./ast.js`, `./interpreter.js`,
+ *   `./cache.js`.
+ * Imported by: `src/runtime/evaluator.ts` (the one-line shim that the old
+ *   `evalCondition` collapses to); H.2's `src/packs/schemas/skill.ts`
+ *   refinement will import `parseExpression` from here.
+ */
+import { cstToAst } from './ast.js';
+import { getCached, setCached } from './cache.js';
+import { evaluate, InterpreterLimitError, InterpreterRuntimeError } from './interpreter.js';
+import { lexer } from './lexer.js';
+import { parseToCst } from './parser.js';
+/**
+ * Evaluate an `if:` expression against the supplied bindings.
+ *
+ * Returns `true` to mean "run the step", `false` to mean "skip the step".
+ * Errors at every layer fail closed to `false` + `console.warn` so a broken
+ * predicate never silently mis-fires a verdict; the warn surfaces the failure
+ * during pack-author development.
+ */
+export function evalCondition(expr, bindings) {
+    const trimmed = expr.trim();
+    // Per pre-research §12.2 lock: empty `if:` (or whitespace-only) is treated
+    // as a present-but-trivial truthy predicate. Symmetric with the absent-
+    // field case at evaluator.ts:169 which already short-circuits.
+    if (trimmed === '')
+        return true;
+    let ast = getCached(trimmed);
+    if (!ast) {
+        const lex = lexer.tokenize(trimmed);
+        if (lex.errors.length > 0) {
+            console.warn(`[opensquid:evaluator] lex error on ${JSON.stringify(expr)}: ${lex.errors[0].message}`);
+            return false;
+        }
+        const { cst, errors } = parseToCst(lex);
+        if (errors.length > 0) {
+            console.warn(`[opensquid:evaluator] parse error on ${JSON.stringify(expr)}: ${errors[0].message}`);
+            return false;
+        }
+        try {
+            ast = cstToAst(cst);
+        }
+        catch (e) {
+            console.warn(`[opensquid:evaluator] AST error on ${JSON.stringify(expr)}: ${e.message}`);
+            return false;
+        }
+        setCached(trimmed, ast);
+    }
+    try {
+        return Boolean(evaluate(ast, { bindings, steps: 0 }));
+    }
+    catch (e) {
+        if (e instanceof InterpreterLimitError) {
+            console.warn(`[opensquid:evaluator] interpreter limit on ${JSON.stringify(expr)}: ${e.message}`);
+        }
+        else if (e instanceof InterpreterRuntimeError) {
+            console.warn(`[opensquid:evaluator] runtime error on ${JSON.stringify(expr)}: ${e.message}`);
+        }
+        else {
+            console.warn(`[opensquid:evaluator] unexpected error on ${JSON.stringify(expr)}: ${e.message}`);
+        }
+        return false;
+    }
+}
+/**
+ * Parse-only entry for load-time validation (H.2 Zod refinement).
+ *
+ * Throws on any of the 3 error tiers (lex / parse / AST). Callers wrap in
+ * try/catch and surface the message via `z.string().refine()` so pack-load
+ * errors point at the offending `if:` clause via the source-path prefix
+ * already attached by `parseYamlFile`.
+ *
+ * Empty-string here is treated as an authoring mistake (the load-time
+ * surface should reject empties — only the runtime surface is forgiving per
+ * §12.2). Callers that want the runtime-style "empty is true" behavior
+ * should guard at the caller, not here.
+ */
+export function parseExpression(expr) {
+    const trimmed = expr.trim();
+    if (trimmed === '')
+        throw new Error('empty expression');
+    const lex = lexer.tokenize(trimmed);
+    if (lex.errors.length > 0)
+        throw new Error(lex.errors[0].message);
+    const { cst, errors } = parseToCst(lex);
+    if (errors.length > 0)
+        throw new Error(errors[0].message);
+    return cstToAst(cst);
+}
+//# sourceMappingURL=index.js.map

package/dist/runtime/evaluator/expression/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../../src/runtime/evaluator/expression/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4DG;AAEH,OAAO,EAAE,QAAQ,EAAgB,MAAM,UAAU,CAAC;AAClD,OAAO,EAAE,SAAS,EAAE,SAAS,EAAE,MAAM,YAAY,CAAC;AAClD,OAAO,EAAE,QAAQ,EAAE,qBAAqB,EAAE,uBAAuB,EAAE,MAAM,kBAAkB,CAAC;AAC5F,OAAO,EAAE,KAAK,EAAE,MAAM,YAAY,CAAC;AACnC,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAEzC;;;;;;;GAOG;AACH,MAAM,UAAU,aAAa,CAAC,IAAY,EAAE,QAA8B;IACxE,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC;IAC5B,2EAA2E;IAC3E,wEAAwE;IACxE,+DAA+D;IAC/D,IAAI,OAAO,KAAK,EAAE;QAAE,OAAO,IAAI,CAAC;IAEhC,IAAI,GAAG,GAAG,SAAS,CAAC,OAAO,CAAC,CAAC;IAC7B,IAAI,CAAC,GAAG,EAAE,CAAC;QACT,MAAM,GAAG,GAAG,KAAK,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;QACpC,IAAI,GAAG,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAC1B,OAAO,CAAC,IAAI,CACV,sCAAsC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,KAAK,GAAG,CAAC,MAAM,CAAC,CAAC,CAAE,CAAC,OAAO,EAAE,CACxF,CAAC;YACF,OAAO,KAAK,CAAC;QACf,CAAC;QACD,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,GAAG,UAAU,CAAC,GAAG,CAAC,CAAC;QACxC,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACtB,OAAO,CAAC,IAAI,CACV,wCAAwC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,KAAK,MAAM,CAAC,CAAC,CAAE,CAAC,OAAO,EAAE,CACtF,CAAC;YACF,OAAO,KAAK,CAAC;QACf,CAAC;QACD,IAAI,CAAC;YACH,GAAG,GAAG,QAAQ,CAAC,GAAG,CAAC,CAAC;QACtB,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACX,OAAO,CAAC,IAAI,CACV,sCAAsC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,KAAM,CAAW,CAAC,OAAO,EAAE,CACtF,CAAC;YACF,OAAO,KAAK,CAAC;QACf,CAAC;QACD,SAAS,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC;IAC1B,CAAC;IAED,IAAI,CAAC;QACH,OAAO,OAAO,CAAC,QAAQ,CAAC,GAAG,EAAE,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC;IACxD,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,IAAI,CAAC,YAAY,qBAAqB,EAAE,CAAC;YACvC,OAAO,CAAC,IAAI,CACV,8CAA8C,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,OAAO,EAAE,CACnF,CAAC;QACJ,CAAC;aAAM,IAAI,CAAC,YAAY,uBAAuB,EAAE,CAAC;YAChD,OAAO,CAAC,IAAI,CAAC,0CAA0C,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC;QAC/F,CAAC;aAAM,CAAC;YACN,OAAO,CAAC,IAAI,CACV,6CAA6C,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,KAAM,CAAW,CAAC,OAAO,EAAE,CAC7F,CAAC;QACJ,CAAC;QACD,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED;;;;;;;;;;;;GAYG;AACH,MAAM,UAAU,eAAe,CAAC,IAAY;IAC1C,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC;IAC5B,IAAI,OAAO,KAAK,EAAE;QAAE,MAAM,IAAI,KAAK,CAAC,kBAAkB,CAAC,CAAC;IACxD,MAAM,GAAG,GAAG,KAAK,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;IACpC,IAAI,GAAG,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAE,CAAC,OAAO,CAAC,CAAC;IACnE,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,GAAG,UAAU,CAAC,GAAG,CAAC,CAAC;IACxC,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,MAAM,CAAC,CAAC,CAAE,CAAC,OAAO,CAAC,CAAC;IAC3D,OAAO,QAAQ,CAAC,GAAG,CAAC,CAAC;AACvB,CAAC"}

package/dist/runtime/evaluator/expression/interpreter.d.ts

@@ -0,0 +1,83 @@
+/**
+ * Tree-walking interpreter + sandbox + path resolver — Task H.1.4.
+ *
+ * Sandbox guarantees (pre-research §3.3):
+ *   1. No string-eval / no dynamic Function-constructor — audit-grep
+ *      invariant on this file (see pre-research §3.1 on why we reject
+ *      Node's vm + the VM2 family).
+ *   2. No prototype access — every path step uses `Object.hasOwn`, blocking
+ *      reserved JS property names like the dunder-proto slot, the ctor
+ *      slot, the proto slot, toString, etc.
+ *   3. Depth cap 64 — guards against stack-overflow from pathological ASTs.
+ *      Counted at each recursive `evaluate()` entry (depth + 1 per descent).
+ *   4. Step cap 10_000 — guards against compute-bound DoS from compound
+ *      expressions. Counted at every `evaluate()` call (before any branch).
+ *   5. Allow-listed function dispatch only — `FUNCTIONS` registry lookup
+ *      (frozen, null-prototype base — see functions.ts); missing names
+ *      throw `InterpreterRuntimeError`. Tests inject a per-call writable
+ *      registry via `EvalCtx.functions`; production callers omit it and
+ *      get the audited 5-function default (`len`, `contains`, `match`,
+ *      `startsWith`, `endsWith`).
+ *   6. No filesystem / network / process / time / random access in any path.
+ *   7. Comparison operators use STRICT equality per pre-research §12.3 lock
+ *      — no `String()` coercion. `==` and `===` both lower to the same
+ *      `BinaryOp.'=='` (lexer collapses `EqEq`); same for `!=` / `!==`.
+ *
+ * Errors fall into two classes — both are caught by the outer evaluator
+ * driver (lands later in H.1.6) which converts to `false + warn`:
+ *   - `InterpreterLimitError` — depth or step cap hit.
+ *   - `InterpreterRuntimeError` — unknown function call (only runtime-
+ *     reachable error in H.1.4; type-mismatches return `false`, not throw).
+ *
+ * Design comparison (pre-research §3.1): we use the Lua/Cerbos pattern of
+ * runtime visit-counting rather than Cerbos's precomputed cost analysis
+ * (simpler, equally safe for our size). We explicitly REJECT Node's `vm`
+ * module + VM2 (CVE-2023-29017) — the tree-walking interpreter pattern is
+ * the safe choice for in-process untrusted expression evaluation.
+ */
+import { type ASTNode } from './ast.js';
+import { type FnHandler } from './functions.js';
+/** AST-nesting depth cap. See pre-research §3.2. */
+export declare const MAX_DEPTH = 64;
+/** Per-eval node-visit cap. See pre-research §3.2. */
+export declare const MAX_STEPS = 10000;
+/** Thrown when depth or step cap is exceeded. Caller converts to `false`. */
+export declare class InterpreterLimitError extends Error {
+    constructor(message: string);
+}
+/** Thrown for runtime conditions like unknown function names. */
+export declare class InterpreterRuntimeError extends Error {
+    constructor(message: string);
+}
+/**
+ * Per-evaluation context. Pass a fresh `EvalCtx` per top-level evaluation —
+ * `steps` is mutated to count every node visit across the whole tree.
+ * `bindings` is a plain `Map` so author-supplied keys can't collide with
+ * Object.prototype keys (a `Map<string, unknown>` doesn't share prototype
+ * keys with the binding value lookups).
+ */
+export interface EvalCtx {
+    bindings: Map<string, unknown>;
+    /** Mutated per visit; `evaluate` throws `InterpreterLimitError` on overrun. */
+    steps: number;
+    /**
+     * Optional function-registry override. Defaults to the frozen `FUNCTIONS`
+     * import. Tests pass a per-call writable registry to inject throwing
+     * stubs (short-circuit proofs) and arg-passthrough captures without
+     * mutating the frozen production registry. Production callers (the H.1.6
+     * `evalCondition` driver) omit this field — the default is the correct,
+     * audited allow-list.
+     */
+    functions?: Record<string, FnHandler>;
+}
+/**
+ * Tree-walking evaluator. Returns the typed value of `node` under `ctx`.
+ *
+ * Recursion contract: increment `depth + 1` at every recursive call so the
+ * depth cap measures AST nesting, not call-stack depth (these would diverge
+ * if helpers like `resolvePath` recursed). Increment `ctx.steps` at the top
+ * of each call before any branching so the step cap catches pathological
+ * trees even when the work happens inside a binary's RHS.
+ */
+export declare function evaluate(node: ASTNode, ctx: EvalCtx, depth?: number): unknown;
+//# sourceMappingURL=interpreter.d.ts.map

package/dist/runtime/evaluator/expression/interpreter.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"interpreter.d.ts","sourceRoot":"","sources":["../../../../src/runtime/evaluator/expression/interpreter.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAoCG;AAEH,OAAO,EAAe,KAAK,OAAO,EAAmC,MAAM,UAAU,CAAC;AACtF,OAAO,EAAa,KAAK,SAAS,EAAE,MAAM,gBAAgB,CAAC;AAE3D,oDAAoD;AACpD,eAAO,MAAM,SAAS,KAAK,CAAC;AAC5B,sDAAsD;AACtD,eAAO,MAAM,SAAS,QAAS,CAAC;AAEhC,6EAA6E;AAC7E,qBAAa,qBAAsB,SAAQ,KAAK;gBAClC,OAAO,EAAE,MAAM;CAI5B;AAED,iEAAiE;AACjE,qBAAa,uBAAwB,SAAQ,KAAK;gBACpC,OAAO,EAAE,MAAM;CAI5B;AAED;;;;;;GAMG;AACH,MAAM,WAAW,OAAO;IACtB,QAAQ,EAAE,GAAG,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAC/B,+EAA+E;IAC/E,KAAK,EAAE,MAAM,CAAC;IACd;;;;;;;OAOG;IACH,SAAS,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC;CACvC;AAED;;;;;;;;GAQG;AACH,wBAAgB,QAAQ,CAAC,IAAI,EAAE,OAAO,EAAE,GAAG,EAAE,OAAO,EAAE,KAAK,SAAI,GAAG,OAAO,CAsDxE"}

package/dist/runtime/evaluator/expression/interpreter.js

@@ -0,0 +1,191 @@
+/**
+ * Tree-walking interpreter + sandbox + path resolver — Task H.1.4.
+ *
+ * Sandbox guarantees (pre-research §3.3):
+ *   1. No string-eval / no dynamic Function-constructor — audit-grep
+ *      invariant on this file (see pre-research §3.1 on why we reject
+ *      Node's vm + the VM2 family).
+ *   2. No prototype access — every path step uses `Object.hasOwn`, blocking
+ *      reserved JS property names like the dunder-proto slot, the ctor
+ *      slot, the proto slot, toString, etc.
+ *   3. Depth cap 64 — guards against stack-overflow from pathological ASTs.
+ *      Counted at each recursive `evaluate()` entry (depth + 1 per descent).
+ *   4. Step cap 10_000 — guards against compute-bound DoS from compound
+ *      expressions. Counted at every `evaluate()` call (before any branch).
+ *   5. Allow-listed function dispatch only — `FUNCTIONS` registry lookup
+ *      (frozen, null-prototype base — see functions.ts); missing names
+ *      throw `InterpreterRuntimeError`. Tests inject a per-call writable
+ *      registry via `EvalCtx.functions`; production callers omit it and
+ *      get the audited 5-function default (`len`, `contains`, `match`,
+ *      `startsWith`, `endsWith`).
+ *   6. No filesystem / network / process / time / random access in any path.
+ *   7. Comparison operators use STRICT equality per pre-research §12.3 lock
+ *      — no `String()` coercion. `==` and `===` both lower to the same
+ *      `BinaryOp.'=='` (lexer collapses `EqEq`); same for `!=` / `!==`.
+ *
+ * Errors fall into two classes — both are caught by the outer evaluator
+ * driver (lands later in H.1.6) which converts to `false + warn`:
+ *   - `InterpreterLimitError` — depth or step cap hit.
+ *   - `InterpreterRuntimeError` — unknown function call (only runtime-
+ *     reachable error in H.1.4; type-mismatches return `false`, not throw).
+ *
+ * Design comparison (pre-research §3.1): we use the Lua/Cerbos pattern of
+ * runtime visit-counting rather than Cerbos's precomputed cost analysis
+ * (simpler, equally safe for our size). We explicitly REJECT Node's `vm`
+ * module + VM2 (CVE-2023-29017) — the tree-walking interpreter pattern is
+ * the safe choice for in-process untrusted expression evaluation.
+ */
+import { assertNever } from './ast.js';
+import { FUNCTIONS } from './functions.js';
+/** AST-nesting depth cap. See pre-research §3.2. */
+export const MAX_DEPTH = 64;
+/** Per-eval node-visit cap. See pre-research §3.2. */
+export const MAX_STEPS = 10_000;
+/** Thrown when depth or step cap is exceeded. Caller converts to `false`. */
+export class InterpreterLimitError extends Error {
+    constructor(message) {
+        super(message);
+        this.name = 'InterpreterLimitError';
+    }
+}
+/** Thrown for runtime conditions like unknown function names. */
+export class InterpreterRuntimeError extends Error {
+    constructor(message) {
+        super(message);
+        this.name = 'InterpreterRuntimeError';
+    }
+}
+/**
+ * Tree-walking evaluator. Returns the typed value of `node` under `ctx`.
+ *
+ * Recursion contract: increment `depth + 1` at every recursive call so the
+ * depth cap measures AST nesting, not call-stack depth (these would diverge
+ * if helpers like `resolvePath` recursed). Increment `ctx.steps` at the top
+ * of each call before any branching so the step cap catches pathological
+ * trees even when the work happens inside a binary's RHS.
+ */
+export function evaluate(node, ctx, depth = 0) {
+    if (depth > MAX_DEPTH)
+        throw new InterpreterLimitError(`depth>${MAX_DEPTH}`);
+    if (++ctx.steps > MAX_STEPS)
+        throw new InterpreterLimitError(`steps>${MAX_STEPS}`);
+    switch (node.kind) {
+        case 'literal':
+            return node.value;
+        case 'name':
+            // `Map.get` returns undefined for missing keys — no prototype-chain
+            // lookup. Reserved JS property names (the dunder-proto slot, ctor
+            // slot, etc.) resolve to undefined unless the caller explicitly
+            // `.set()` them (and even then they're ordinary string keys in the
+            // Map, not prototype slots).
+            return ctx.bindings.get(node.id);
+        case 'path':
+            return resolvePath(evaluate(node.target, ctx, depth + 1), node.segments);
+        case 'call': {
+            const registry = ctx.functions ?? FUNCTIONS;
+            // Bracket access on a null-prototype + frozen registry: reserved
+            // JS slot names like `__proto__` / `constructor` resolve to undefined
+            // because the prototype chain has nothing to inherit from.
+            const fn = registry[node.name];
+            if (typeof fn !== 'function') {
+                throw new InterpreterRuntimeError(`unknown function: ${node.name}`);
+            }
+            const args = node.args.map((a) => evaluate(a, ctx, depth + 1));
+            return fn(...args);
+        }
+        case 'unary':
+            // JS-truthy applied to the operand: `!0` is `true`, `!"" ` is `true`,
+            // `!{}` is `false`. Spec test fixture confirms.
+            return !evaluate(node.operand, ctx, depth + 1);
+        case 'binary': {
+            // Short-circuit AND / OR BEFORE evaluating RHS, per the test contract
+            // that a throwing RHS must never fire when the LHS short-circuits.
+            if (node.op === '&&') {
+                const lhs = evaluate(node.lhs, ctx, depth + 1);
+                return lhs ? evaluate(node.rhs, ctx, depth + 1) : lhs;
+            }
+            if (node.op === '||') {
+                const lhs = evaluate(node.lhs, ctx, depth + 1);
+                // Truthy-based short-circuit (matches JS `||` semantics, NOT `??`):
+                // `0 || rhs` must evaluate rhs. eslint's prefer-nullish-coalescing
+                // hint would silently change behavior — keep the ternary.
+                // eslint-disable-next-line @typescript-eslint/prefer-nullish-coalescing -- truthy-based short-circuit; nullish would change semantics.
+                return lhs ? lhs : evaluate(node.rhs, ctx, depth + 1);
+            }
+            const lhs = evaluate(node.lhs, ctx, depth + 1);
+            const rhs = evaluate(node.rhs, ctx, depth + 1);
+            return applyCompare(node.op, lhs, rhs);
+        }
+        default:
+            return assertNever(node);
+    }
+}
+/**
+ * Comparison dispatch. Strict equality per pre-research §12.3 (no `String()`
+ * wrapping). Order/relational ops require BOTH operands to be numbers — type
+ * mismatch returns `false` (fail-closed). The 6 ops here mirror the
+ * non-short-circuit half of `BinaryOp` from ast.ts (8 ops total minus `&&`
+ * and `||` handled inline above).
+ */
+function applyCompare(op, lhs, rhs) {
+    switch (op) {
+        case '==':
+            return lhs === rhs;
+        case '!=':
+            return lhs !== rhs;
+        case '<':
+            return typeof lhs === 'number' && typeof rhs === 'number' && lhs < rhs;
+        case '<=':
+            return typeof lhs === 'number' && typeof rhs === 'number' && lhs <= rhs;
+        case '>':
+            return typeof lhs === 'number' && typeof rhs === 'number' && lhs > rhs;
+        case '>=':
+            return typeof lhs === 'number' && typeof rhs === 'number' && lhs >= rhs;
+        default:
+            return assertNever(op);
+    }
+}
+/**
+ * Walk `segments` against `root`. Null/undefined chains short-circuit to
+ * `undefined`. Property access goes through `Object.hasOwn` to block
+ * prototype-pollution paths (reserved JS slots like dunder-proto, ctor,
+ * etc.). Numeric `length` is the one non-own getter we surface —
+ * preserves G.5 behavior for `matches.length > 0` clauses that pre-date
+ * the chevrotain grammar.
+ */
+function resolvePath(root, segments) {
+    let cur = root;
+    for (const seg of segments) {
+        if (cur === null || cur === undefined)
+            return undefined;
+        if (seg.kind === 'prop') {
+            // `length` special-case: Array.length + String.length are NOT own
+            // properties — they're getter accessors on the prototype. Without
+            // this branch every `matches.length > 0` clause silently returns
+            // `false` and existing G.5 skills regress.
+            if (seg.name === 'length' && (Array.isArray(cur) || typeof cur === 'string')) {
+                cur = cur.length;
+                continue;
+            }
+            if (typeof cur !== 'object' || !Object.hasOwn(cur, seg.name)) {
+                return undefined;
+            }
+            cur = cur[seg.name];
+            continue;
+        }
+        // seg.kind === 'index'
+        if (typeof seg.value === 'number') {
+            if (!Array.isArray(cur))
+                return undefined;
+            cur = cur[seg.value];
+            continue;
+        }
+        // String index — same own-property check as prop access.
+        if (typeof cur !== 'object' || !Object.hasOwn(cur, seg.value)) {
+            return undefined;
+        }
+        cur = cur[seg.value];
+    }
+    return cur;
+}
+//# sourceMappingURL=interpreter.js.map

package/dist/runtime/evaluator/expression/interpreter.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"interpreter.js","sourceRoot":"","sources":["../../../../src/runtime/evaluator/expression/interpreter.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAoCG;AAEH,OAAO,EAAE,WAAW,EAAiD,MAAM,UAAU,CAAC;AACtF,OAAO,EAAE,SAAS,EAAkB,MAAM,gBAAgB,CAAC;AAE3D,oDAAoD;AACpD,MAAM,CAAC,MAAM,SAAS,GAAG,EAAE,CAAC;AAC5B,sDAAsD;AACtD,MAAM,CAAC,MAAM,SAAS,GAAG,MAAM,CAAC;AAEhC,6EAA6E;AAC7E,MAAM,OAAO,qBAAsB,SAAQ,KAAK;IAC9C,YAAY,OAAe;QACzB,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,uBAAuB,CAAC;IACtC,CAAC;CACF;AAED,iEAAiE;AACjE,MAAM,OAAO,uBAAwB,SAAQ,KAAK;IAChD,YAAY,OAAe;QACzB,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,yBAAyB,CAAC;IACxC,CAAC;CACF;AAwBD;;;;;;;;GAQG;AACH,MAAM,UAAU,QAAQ,CAAC,IAAa,EAAE,GAAY,EAAE,KAAK,GAAG,CAAC;IAC7D,IAAI,KAAK,GAAG,SAAS;QAAE,MAAM,IAAI,qBAAqB,CAAC,SAAS,SAAS,EAAE,CAAC,CAAC;IAC7E,IAAI,EAAE,GAAG,CAAC,KAAK,GAAG,SAAS;QAAE,MAAM,IAAI,qBAAqB,CAAC,SAAS,SAAS,EAAE,CAAC,CAAC;IAEnF,QAAQ,IAAI,CAAC,IAAI,EAAE,CAAC;QAClB,KAAK,SAAS;YACZ,OAAO,IAAI,CAAC,KAAK,CAAC;QACpB,KAAK,MAAM;YACT,oEAAoE;YACpE,kEAAkE;YAClE,gEAAgE;YAChE,mEAAmE;YACnE,6BAA6B;YAC7B,OAAO,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QACnC,KAAK,MAAM;YACT,OAAO,WAAW,CAAC,QAAQ,CAAC,IAAI,CAAC,MAAM,EAAE,GAAG,EAAE,KAAK,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,QAAQ,CAAC,CAAC;QAC3E,KAAK,MAAM,CAAC,CAAC,CAAC;YACZ,MAAM,QAAQ,GAAG,GAAG,CAAC,SAAS,IAAI,SAAS,CAAC;YAC5C,iEAAiE;YACjE,sEAAsE;YACtE,2DAA2D;YAC3D,MAAM,EAAE,GAAG,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YAC/B,IAAI,OAAO,EAAE,KAAK,UAAU,EAAE,CAAC;gBAC7B,MAAM,IAAI,uBAAuB,CAAC,qBAAqB,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC;YACtE,CAAC;YACD,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,EAAE,KAAK,GAAG,CAAC,CAAC,CAAC,CAAC;YAC/D,OAAO,EAAE,CAAC,GAAG,IAAI,CAAC,CAAC;QACrB,CAAC;QACD,KAAK,OAAO;YACV,sEAAsE;YACtE,gDAAgD;YAChD,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC,OAAO,EAAE,GAAG,EAAE,KAAK,GAAG,CAAC,CAAC,CAAC;QACjD,KAAK,QAAQ,CAAC,CAAC,CAAC;YACd,sEAAsE;YACtE,mEAAmE;YACnE,IAAI,IAAI,CAAC,EAAE,KAAK,IAAI,EAAE,CAAC;gBACrB,MAAM,GAAG,GAAG,QAAQ,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,KAAK,GAAG,CAAC,CAAC,CAAC;gBAC/C,OAAO,GAAG,CAAC,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,KAAK,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC;YACxD,CAAC;YACD,IAAI,IAAI,CAAC,EAAE,KAAK,IAAI,EAAE,CAAC;gBACrB,MAAM,GAAG,GAAG,QAAQ,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,KAAK,GAAG,CAAC,CAAC,CAAC;gBAC/C,oEAAoE;gBACpE,mEAAmE;gBACnE,0DAA0D;gBAC1D,uIAAuI;gBACvI,OAAO,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,KAAK,GAAG,CAAC,CAAC,CAAC;YACxD,CAAC;YACD,MAAM,GAAG,GAAG,QAAQ,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,KAAK,GAAG,CAAC,CAAC,CAAC;YAC/C,MAAM,GAAG,GAAG,QAAQ,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,KAAK,GAAG,CAAC,CAAC,CAAC;YAC/C,OAAO,YAAY,CAAC,IAAI,CAAC,EAAE,EAAE,GAAG,EAAE,GAAG,CAAC,CAAC;QACzC,CAAC;QACD;YACE,OAAO,WAAW,CAAC,IAAI,CAAC,CAAC;IAC7B,CAAC;AACH,CAAC;AAED;;;;;;GAMG;AACH,SAAS,YAAY,CAAC,EAAkC,EAAE,GAAY,EAAE,GAAY;IAClF,QAAQ,EAAE,EAAE,CAAC;QACX,KAAK,IAAI;YACP,OAAO,GAAG,KAAK,GAAG,CAAC;QACrB,KAAK,IAAI;YACP,OAAO,GAAG,KAAK,GAAG,CAAC;QACrB,KAAK,GAAG;YACN,OAAO,OAAO,GAAG,KAAK,QAAQ,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,GAAG,GAAG,GAAG,CAAC;QACzE,KAAK,IAAI;YACP,OAAO,OAAO,GAAG,KAAK,QAAQ,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,GAAG,IAAI,GAAG,CAAC;QAC1E,KAAK,GAAG;YACN,OAAO,OAAO,GAAG,KAAK,QAAQ,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,GAAG,GAAG,GAAG,CAAC;QACzE,KAAK,IAAI;YACP,OAAO,OAAO,GAAG,KAAK,QAAQ,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,GAAG,IAAI,GAAG,CAAC;QAC1E;YACE,OAAO,WAAW,CAAC,EAAE,CAAC,CAAC;IAC3B,CAAC;AACH,CAAC;AAED;;;;;;;GAOG;AACH,SAAS,WAAW,CAAC,IAAa,EAAE,QAAuB;IACzD,IAAI,GAAG,GAAY,IAAI,CAAC;IACxB,KAAK,MAAM,GAAG,IAAI,QAAQ,EAAE,CAAC;QAC3B,IAAI,GAAG,KAAK,IAAI,IAAI,GAAG,KAAK,SAAS;YAAE,OAAO,SAAS,CAAC;QACxD,IAAI,GAAG,CAAC,IAAI,KAAK,MAAM,EAAE,CAAC;YACxB,kEAAkE;YAClE,kEAAkE;YAClE,iEAAiE;YACjE,2CAA2C;YAC3C,IAAI,GAAG,CAAC,IAAI,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,OAAO,GAAG,KAAK,QAAQ,CAAC,EAAE,CAAC;gBAC7E,GAAG,GAAI,GAA0B,CAAC,MAAM,CAAC;gBACzC,SAAS;YACX,CAAC;YACD,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,GAAG,EAAE,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;gBAC7D,OAAO,SAAS,CAAC;YACnB,CAAC;YACD,GAAG,GAAI,GAA+B,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;YACjD,SAAS;QACX,CAAC;QACD,uBAAuB;QACvB,IAAI,OAAO,GAAG,CAAC,KAAK,KAAK,QAAQ,EAAE,CAAC;YAClC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC;gBAAE,OAAO,SAAS,CAAC;YAC1C,GAAG,GAAG,GAAG,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;YACrB,SAAS;QACX,CAAC;QACD,yDAAyD;QACzD,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,GAAG,EAAE,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC;YAC9D,OAAO,SAAS,CAAC;QACnB,CAAC;QACD,GAAG,GAAI,GAA+B,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;IACpD,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC"}

package/dist/runtime/evaluator/expression/lexer.d.ts

@@ -0,0 +1,63 @@
+/**
+ * Expression lexer — Task H.1.1 (chevrotain v11).
+ *
+ * Tokens for the `if:` expression grammar that replaces the regex-bounded
+ * evaluator at src/runtime/evaluator.ts:503. Twenty tokens total: literals
+ * (StringLit / NumberLit / True / False / Null), comparison + logical
+ * operators, grouping punctuation, and Identifier. WhiteSpace is captured
+ * but discarded via the Lexer.SKIPPED group so the parser never sees it.
+ *
+ * Longest-match discipline: chevrotain walks `allTokens` in array order, so
+ * multi-character operators MUST precede their single-character prefixes
+ * (EqEq before any `=`-prefixed single token; NotEq before Bang; Lte/Gte
+ * before Lt/Gt; AndAnd/OrOr before any single `&` / `|` which are NOT
+ * tokenized — they would surface as a lexer error). Keywords use `\b`
+ * word-boundaries so `truer` lexes as a single Identifier rather than
+ * [True, Identifier("r")].
+ *
+ * No regex backtracking risk: every pattern is linear-time. StringLit's
+ * `/"(?:[^"\\]|\\.)*"/` has no nested quantifiers (each alternative consumes
+ * exactly one character of input). Audit-grep in the task spec verifies no
+ * lookarounds / possessive / nested quantifiers ever land here.
+ *
+ * Pinned to chevrotain ^11.0.0 — v12 requires Node 22+ but opensquid pins
+ * `engines.node: ">=20.0.0"`.
+ *
+ * Imported by: src/runtime/evaluator/expression/parser.ts (H.1.2).
+ */
+import { Lexer } from 'chevrotain';
+export declare const StringLit: import("chevrotain").TokenType;
+export declare const NumberLit: import("chevrotain").TokenType;
+export declare const True: import("chevrotain").TokenType;
+export declare const False: import("chevrotain").TokenType;
+export declare const Null: import("chevrotain").TokenType;
+export declare const EqEq: import("chevrotain").TokenType;
+export declare const NotEq: import("chevrotain").TokenType;
+export declare const Lte: import("chevrotain").TokenType;
+export declare const Gte: import("chevrotain").TokenType;
+export declare const Lt: import("chevrotain").TokenType;
+export declare const Gt: import("chevrotain").TokenType;
+export declare const AndAnd: import("chevrotain").TokenType;
+export declare const OrOr: import("chevrotain").TokenType;
+export declare const Bang: import("chevrotain").TokenType;
+export declare const LParen: import("chevrotain").TokenType;
+export declare const RParen: import("chevrotain").TokenType;
+export declare const LBracket: import("chevrotain").TokenType;
+export declare const RBracket: import("chevrotain").TokenType;
+export declare const Comma: import("chevrotain").TokenType;
+export declare const Dot: import("chevrotain").TokenType;
+export declare const Identifier: import("chevrotain").TokenType;
+export declare const WhiteSpace: import("chevrotain").TokenType;
+/**
+ * Token order locks longest-match behavior. WhiteSpace can sit anywhere
+ * (it's SKIPPED), but keywords MUST precede Identifier, and multi-char
+ * operators MUST precede their single-char prefixes.
+ */
+export declare const allTokens: import("chevrotain").TokenType[];
+/**
+ * Singleton Lexer instance — chevrotain perf guide recommends reuse across
+ * tokenize() calls. The Lexer is stateless across calls; only its result is
+ * per-invocation.
+ */
+export declare const lexer: Lexer;
+//# sourceMappingURL=lexer.d.ts.map

package/dist/runtime/evaluator/expression/lexer.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"lexer.d.ts","sourceRoot":"","sources":["../../../../src/runtime/evaluator/expression/lexer.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AAEH,OAAO,EAAe,KAAK,EAAE,MAAM,YAAY,CAAC;AAIhD,eAAO,MAAM,SAAS,gCAAmE,CAAC;AAC1F,eAAO,MAAM,SAAS,gCAA+D,CAAC;AAGtF,eAAO,MAAM,IAAI,gCAAmD,CAAC;AACrE,eAAO,MAAM,KAAK,gCAAqD,CAAC;AACxE,eAAO,MAAM,IAAI,gCAAmD,CAAC;AAGrE,eAAO,MAAM,IAAI,gCAAmD,CAAC;AACrE,eAAO,MAAM,KAAK,gCAAoD,CAAC;AACvE,eAAO,MAAM,GAAG,gCAA8C,CAAC;AAC/D,eAAO,MAAM,GAAG,gCAA8C,CAAC;AAC/D,eAAO,MAAM,EAAE,gCAA4C,CAAC;AAC5D,eAAO,MAAM,EAAE,gCAA4C,CAAC;AAC5D,eAAO,MAAM,MAAM,gCAAiD,CAAC;AACrE,eAAO,MAAM,IAAI,gCAAiD,CAAC;AACnE,eAAO,MAAM,IAAI,gCAA8C,CAAC;AAIhE,eAAO,MAAM,MAAM,gCAAiD,CAAC;AACrE,eAAO,MAAM,MAAM,gCAAiD,CAAC;AACrE,eAAO,MAAM,QAAQ,gCAAmD,CAAC;AACzE,eAAO,MAAM,QAAQ,gCAAmD,CAAC;AACzE,eAAO,MAAM,KAAK,gCAA+C,CAAC;AAClE,eAAO,MAAM,GAAG,gCAA8C,CAAC;AAK/D,eAAO,MAAM,UAAU,gCAA+D,CAAC;AAGvF,eAAO,MAAM,UAAU,gCAIrB,CAAC;AAEH;;;;GAIG;AACH,eAAO,MAAM,SAAS,kCAuBrB,CAAC;AAEF;;;;GAIG;AACH,eAAO,MAAM,KAAK,OAAuB,CAAC"}

package/dist/runtime/evaluator/expression/lexer.js

@@ -0,0 +1,98 @@
+/**
+ * Expression lexer — Task H.1.1 (chevrotain v11).
+ *
+ * Tokens for the `if:` expression grammar that replaces the regex-bounded
+ * evaluator at src/runtime/evaluator.ts:503. Twenty tokens total: literals
+ * (StringLit / NumberLit / True / False / Null), comparison + logical
+ * operators, grouping punctuation, and Identifier. WhiteSpace is captured
+ * but discarded via the Lexer.SKIPPED group so the parser never sees it.
+ *
+ * Longest-match discipline: chevrotain walks `allTokens` in array order, so
+ * multi-character operators MUST precede their single-character prefixes
+ * (EqEq before any `=`-prefixed single token; NotEq before Bang; Lte/Gte
+ * before Lt/Gt; AndAnd/OrOr before any single `&` / `|` which are NOT
+ * tokenized — they would surface as a lexer error). Keywords use `\b`
+ * word-boundaries so `truer` lexes as a single Identifier rather than
+ * [True, Identifier("r")].
+ *
+ * No regex backtracking risk: every pattern is linear-time. StringLit's
+ * `/"(?:[^"\\]|\\.)*"/` has no nested quantifiers (each alternative consumes
+ * exactly one character of input). Audit-grep in the task spec verifies no
+ * lookarounds / possessive / nested quantifiers ever land here.
+ *
+ * Pinned to chevrotain ^11.0.0 — v12 requires Node 22+ but opensquid pins
+ * `engines.node: ">=20.0.0"`.
+ *
+ * Imported by: src/runtime/evaluator/expression/parser.ts (H.1.2).
+ */
+import { createToken, Lexer } from 'chevrotain';
+// Literals -----------------------------------------------------------------
+export const StringLit = createToken({ name: 'StringLit', pattern: /"(?:[^"\\]|\\.)*"/ });
+export const NumberLit = createToken({ name: 'NumberLit', pattern: /\d+(?:\.\d+)?/ });
+// Keywords — `\b` ensures `truer` / `falsey` / `nullable` are Identifiers.
+export const True = createToken({ name: 'True', pattern: /true\b/ });
+export const False = createToken({ name: 'False', pattern: /false\b/ });
+export const Null = createToken({ name: 'Null', pattern: /null\b/ });
+// Operators — multi-char FIRST so longest-match wins.
+export const EqEq = createToken({ name: 'EqEq', pattern: /===|==/ });
+export const NotEq = createToken({ name: 'NotEq', pattern: /!==|!=/ });
+export const Lte = createToken({ name: 'Lte', pattern: /<=/ });
+export const Gte = createToken({ name: 'Gte', pattern: />=/ });
+export const Lt = createToken({ name: 'Lt', pattern: /</ });
+export const Gt = createToken({ name: 'Gt', pattern: />/ });
+export const AndAnd = createToken({ name: 'AndAnd', pattern: /&&/ });
+export const OrOr = createToken({ name: 'OrOr', pattern: /\|\|/ });
+export const Bang = createToken({ name: 'Bang', pattern: /!/ });
+// Punctuation -------------------------------------------------------------
+export const LParen = createToken({ name: 'LParen', pattern: /\(/ });
+export const RParen = createToken({ name: 'RParen', pattern: /\)/ });
+export const LBracket = createToken({ name: 'LBracket', pattern: /\[/ });
+export const RBracket = createToken({ name: 'RBracket', pattern: /\]/ });
+export const Comma = createToken({ name: 'Comma', pattern: /,/ });
+export const Dot = createToken({ name: 'Dot', pattern: /\./ });
+// Identifier comes LAST so keywords (True/False/Null) win when the input
+// matches `true` / `false` / `null` exactly. chevrotain's longest-match
+// resolves ties by declaration order: earlier wins.
+export const Identifier = createToken({ name: 'Identifier', pattern: /[A-Za-z_]\w*/ });
+// Whitespace is captured but dropped before the parser sees it.
+export const WhiteSpace = createToken({
+    name: 'WhiteSpace',
+    pattern: /\s+/,
+    group: Lexer.SKIPPED,
+});
+/**
+ * Token order locks longest-match behavior. WhiteSpace can sit anywhere
+ * (it's SKIPPED), but keywords MUST precede Identifier, and multi-char
+ * operators MUST precede their single-char prefixes.
+ */
+export const allTokens = [
+    WhiteSpace,
+    StringLit,
+    NumberLit,
+    True,
+    False,
+    Null,
+    EqEq,
+    NotEq,
+    Lte,
+    Gte,
+    Lt,
+    Gt,
+    AndAnd,
+    OrOr,
+    Bang,
+    LParen,
+    RParen,
+    LBracket,
+    RBracket,
+    Comma,
+    Dot,
+    Identifier,
+];
+/**
+ * Singleton Lexer instance — chevrotain perf guide recommends reuse across
+ * tokenize() calls. The Lexer is stateless across calls; only its result is
+ * per-invocation.
+ */
+export const lexer = new Lexer(allTokens);
+//# sourceMappingURL=lexer.js.map

package/dist/runtime/evaluator/expression/lexer.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"lexer.js","sourceRoot":"","sources":["../../../../src/runtime/evaluator/expression/lexer.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AAEH,OAAO,EAAE,WAAW,EAAE,KAAK,EAAE,MAAM,YAAY,CAAC;AAEhD,6EAA6E;AAE7E,MAAM,CAAC,MAAM,SAAS,GAAG,WAAW,CAAC,EAAE,IAAI,EAAE,WAAW,EAAE,OAAO,EAAE,mBAAmB,EAAE,CAAC,CAAC;AAC1F,MAAM,CAAC,MAAM,SAAS,GAAG,WAAW,CAAC,EAAE,IAAI,EAAE,WAAW,EAAE,OAAO,EAAE,eAAe,EAAE,CAAC,CAAC;AAEtF,2EAA2E;AAC3E,MAAM,CAAC,MAAM,IAAI,GAAG,WAAW,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,QAAQ,EAAE,CAAC,CAAC;AACrE,MAAM,CAAC,MAAM,KAAK,GAAG,WAAW,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,OAAO,EAAE,SAAS,EAAE,CAAC,CAAC;AACxE,MAAM,CAAC,MAAM,IAAI,GAAG,WAAW,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,QAAQ,EAAE,CAAC,CAAC;AAErE,sDAAsD;AACtD,MAAM,CAAC,MAAM,IAAI,GAAG,WAAW,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,QAAQ,EAAE,CAAC,CAAC;AACrE,MAAM,CAAC,MAAM,KAAK,GAAG,WAAW,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,CAAC,CAAC;AACvE,MAAM,CAAC,MAAM,GAAG,GAAG,WAAW,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC;AAC/D,MAAM,CAAC,MAAM,GAAG,GAAG,WAAW,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC;AAC/D,MAAM,CAAC,MAAM,EAAE,GAAG,WAAW,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,OAAO,EAAE,GAAG,EAAE,CAAC,CAAC;AAC5D,MAAM,CAAC,MAAM,EAAE,GAAG,WAAW,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,OAAO,EAAE,GAAG,EAAE,CAAC,CAAC;AAC5D,MAAM,CAAC,MAAM,MAAM,GAAG,WAAW,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC;AACrE,MAAM,CAAC,MAAM,IAAI,GAAG,WAAW,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,CAAC,CAAC;AACnE,MAAM,CAAC,MAAM,IAAI,GAAG,WAAW,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,GAAG,EAAE,CAAC,CAAC;AAEhE,4EAA4E;AAE5E,MAAM,CAAC,MAAM,MAAM,GAAG,WAAW,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC;AACrE,MAAM,CAAC,MAAM,MAAM,GAAG,WAAW,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC;AACrE,MAAM,CAAC,MAAM,QAAQ,GAAG,WAAW,CAAC,EAAE,IAAI,EAAE,UAAU,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC;AACzE,MAAM,CAAC,MAAM,QAAQ,GAAG,WAAW,CAAC,EAAE,IAAI,EAAE,UAAU,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC;AACzE,MAAM,CAAC,MAAM,KAAK,GAAG,WAAW,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,OAAO,EAAE,GAAG,EAAE,CAAC,CAAC;AAClE,MAAM,CAAC,MAAM,GAAG,GAAG,WAAW,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC;AAE/D,yEAAyE;AACzE,wEAAwE;AACxE,oDAAoD;AACpD,MAAM,CAAC,MAAM,UAAU,GAAG,WAAW,CAAC,EAAE,IAAI,EAAE,YAAY,EAAE,OAAO,EAAE,cAAc,EAAE,CAAC,CAAC;AAEvF,gEAAgE;AAChE,MAAM,CAAC,MAAM,UAAU,GAAG,WAAW,CAAC;IACpC,IAAI,EAAE,YAAY;IAClB,OAAO,EAAE,KAAK;IACd,KAAK,EAAE,KAAK,CAAC,OAAO;CACrB,CAAC,CAAC;AAEH;;;;GAIG;AACH,MAAM,CAAC,MAAM,SAAS,GAAG;IACvB,UAAU;IACV,SAAS;IACT,SAAS;IACT,IAAI;IACJ,KAAK;IACL,IAAI;IACJ,IAAI;IACJ,KAAK;IACL,GAAG;IACH,GAAG;IACH,EAAE;IACF,EAAE;IACF,MAAM;IACN,IAAI;IACJ,IAAI;IACJ,MAAM;IACN,MAAM;IACN,QAAQ;IACR,QAAQ;IACR,KAAK;IACL,GAAG;IACH,UAAU;CACX,CAAC;AAEF;;;;GAIG;AACH,MAAM,CAAC,MAAM,KAAK,GAAG,IAAI,KAAK,CAAC,SAAS,CAAC,CAAC"}