jsonatapy 2.2.8__tar.gz → 2.2.9__tar.gz

{jsonatapy-2.2.8 → jsonatapy-2.2.9}/.gitignore

@@ -71,3 +71,4 @@ benchmarks/javascript/package-lock.json
 # Temporary files
 *.tmp
 *.bak
+*.exe

{jsonatapy-2.2.8 → jsonatapy-2.2.9}/.serena/memories/architecture.md

@@ -45,9 +45,12 @@ site (grep `unwrap_or(JValue::Null)` / `JValue::Null =>` near field-access code)
 ### Compilation pipeline (bytecode fast path)
 `evaluator::try_compile_expr(ast)` → `CompiledExpr` (IR) → `compiler::BytecodeCompiler::compile`
 → `BytecodeProgram` (flat `Vec<Instr>`) → `peephole()` folds (`PushData+GetField` →
-`GetDataField`, `GetVar+GetField` → `GetVarField`, elides `Not+Not`) → `vm::Vm::new(bc).run(...)`.
-`JsonataExpression` (lib.rs) caches `bytecode: OnceCell<Option<BytecodeProgram>>`; all 4 evaluate
-entrypoints try the VM first and fall back to the tree-walker.
+`GetDataField`, `GetVar+GetField` → `GetVarField`, elides `Not+Not`) →
+`vm::Vm::with_options(bc, options).run(...)`.
+`JsonataExpression` (lib.rs) caches `bytecode: OnceCell<Option<BytecodeProgram>>`; all 5 evaluate
+entrypoints funnel through `run_eval`, which tries the VM first and falls back to the tree-walker.
+The `vm`/`compiler` modules exist only under the `python`, `capi`, or `bench` features (cfg-gated
+in lib.rs) — a default-feature build, including the Rust CLI, always uses the tree-walker.
 
 Key correctness rules baked into the compiler/VM (violate these and specific test-suite groups
 regress):

{jsonatapy-2.2.8 → jsonatapy-2.2.9}/CHANGELOG.md

@@ -19,6 +19,198 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ### Security
 
+## [2.2.9] "Perform-ata" - 2026-08-31
+
+### Changed
+- Lambda values now carry their closure directly — `JValue::Lambda(Rc<StoredLambda>)`
+  instead of a `lambda_id` name tag resolved through a per-scope side table (#157).
+  The `Rc` provides the closure's lifetime, so the side table (`Scope.lambdas`),
+  the escape-analysis GC (`extract_lambda_ids`/`collect_lambda_ids` walking every
+  block/lambda result, `pop_scope_preserving_lambdas`) and the dual-map handling in
+  `unbind`/`clear_current_scope` are gone, along with the O(result size) walk on
+  every scope pop. Recursion is late-bound letrec: a closure defined as
+  `$f := function ...` records its own name and binds it to itself at each
+  invocation, so no `Rc` cycles exist and closures cannot leak (guarded by a
+  live-count test). Free-variable capture remains a by-value snapshot at
+  definition time, now applied uniformly to lambda-valued variables too.
+  Behavioral fixes (all matching jsonata-js, pinned in
+  `tests/lambda_closure_suite.rs`): a transform bound to a variable is callable
+  and pipeable (`$t := |...|...|; $t(x)`, `x ~> $t`); a partial application
+  escaping the scope that defined its target function works; an alias
+  (`$g := $f`) survives `$f` being rebound; calling a name rebound to a
+  non-function raises T1006 instead of silently invoking the stale lambda; a
+  closure captured inside another escaping closure's environment no longer
+  dangles. Function equality is now closure identity rather than id-string
+  equality. Remaining known divergences from jsonata-js's live-frame capture
+  are documented in the same suite's `divergent_from_reference` module.
+- Partial application is a typed representation instead of a stringly-typed
+  protocol: `StoredLambda` carries an optional `PartialApplication { target,
+  bound_args, placeholder_positions, total_args }`, replacing the
+  `"__partial_call:name:bool:n"` marker-string body that was parsed at every
+  invocation and the `__bound_arg_N` / `__placeholder_positions` /
+  `__total_args` / `__partial_target` values smuggled through `captured_env`.
+  A user-defined target is a captured closure (`PartialTarget::Lambda`);
+  builtins/host functions stay name-resolved at call time
+  (`PartialTarget::Named`), preserving call-time shadowing. Partials no longer
+  snapshot the entire environment at creation (the old
+  `capture_current_environment()` call was only ever a smuggling container),
+  and one behavior corner now matches jsonata-js: rebinding a user function
+  after partially applying it no longer changes what the partial calls
+  (pinned in `tests/lambda_closure_suite.rs` with eight other partial pins).
+
+### Added
+- `jsonata_set_limits` on the C ABI: wall-clock timeout (D1012), max AST recursion
+  depth (D1011), and max sequence length (D2015) — the same three guardrails the
+  Python bindings expose. C embedders previously had no way to bound a runaway
+  expression at all (the cleanup review's finding); 0 = unlimited, resettable per
+  handle. Covered by the C/C++ smoke tests and a Rust-side capi test.
+- `jsonata_core::Expression` — a compile-once API for Rust callers that runs
+  compilable expressions on the bytecode VM, exactly like the Python and C
+  bindings always have. Until now the VM was unreachable from the pure-Rust
+  surface: `Evaluator` always tree-walks, so Rust (and CLI) callers silently
+  got the slower path. `Expression::compile(src)?.evaluate(&data)` lowers to
+  bytecode lazily and falls back to the tree-walker for non-compilable
+  expressions; bindings and host functions still go through `Evaluator`. The
+  dispatch now lives in one place (`expression::run_compiled`), shared by the
+  Rust API, the Python bindings' `run_eval`, and the C ABI (which previously
+  carried a hand-copied duplicate of it), and the CLI uses it when no `--arg`
+  bindings are given. The `vm`/`compiler` modules are unconditionally compiled
+  again (the cfg gates added earlier in this cycle are gone — the default
+  build now has a real consumer).
+
+### Changed
+- Python→Rust data conversion — the cost that dominates `evaluate(dict)` on array-heavy
+  inputs — is faster on two fronts. `lazy::convert` now dispatches on the exact type object
+  and iterates lists via borrowed references instead of pyo3's instance-check chain
+  (subclasses still take the original chain, so semantics, error types included, are
+  unchanged; pinned by `tests/python/test_convert_fastpath.py`). And the published wheels
+  now use mimalloc as the global allocator (new opt-in `mimalloc` cargo feature, enabled in
+  `pyproject.toml`), roughly halving the per-list/per-object allocation cost that JValue's
+  Rc-per-container representation makes the conversion floor. Measured together on the
+  benchmark suite's shapes: "Nested Array Access" (`data[1][1][1][1]`, the one row where
+  jsonata-js was still ahead) drops ~35% (12.0µs → 7.8µs on the dev container), the four
+  `lazy_check.py` gate rows drop 10–17%, and string-heavy conversion roughly halves. The
+  structural fix for the nested-array row — lazy list views — remains deferred (see the
+  2026-07-12 lazy-views spec's Limitations).
+- The `vm` and `compiler` modules (the bytecode pipeline) are now cfg-gated on the features
+  that actually consume them (`python`, `capi`, `bench`) — they were compiled but unreachable
+  in a default-feature build, producing 12 permanent dead-code warnings that CI's
+  `--all-features` clippy never saw. A default `cargo build` is now warning-clean, and both
+  modules carry a header note naming their consumers. List and dict *subclasses* now take the
+  boundary converter's fast path too (`PyList_Check`/`PyDict_Check`; iteration was already
+  C-level for them, so behavior is unchanged), which let the duplicate slow-path container
+  loops be deleted.
+
+### Changed (evaluator internals)
+- The vestigial `*_is_explicit_null` plumbing is gone: since the null/undefined split
+  (#32) a runtime `JValue::Null` is always an explicit null, yet the flags were still
+  computed and threaded through ~20 signatures — nine arithmetic/comparison wrapper
+  methods, the `CompiledExpr::ExplicitNull` variant (now `Literal(Null)`), a
+  `PushExplicitNull` instruction, and per-instruction bool pairs on the VM's
+  arithmetic/comparison opcodes — with both terminal consumers ignoring them (~200
+  lines removed). Arithmetic and ordered comparison now have exactly one
+  implementation each, shared by the tree-walker, the compiled path, and the VM; as
+  part of that, the compiled/VM paths' T2010/T2009 error texts now match the
+  tree-walker's richer messages ("Cannot compare X and Y", operator symbol in T2009)
+  instead of the generic "Type mismatch in comparison" — same codes, better text, and
+  the two engines no longer disagree. `Evaluator::is_truthy` likewise now delegates to
+  the shared `compiled_is_truthy` instead of maintaining a twin (#111 had to be fixed
+  in both).
+- More single-definition consolidation: the two verbatim 45-line signature-error
+  translation blocks (direct vs TCO lambda invocation) are one `coerce_lambda_args`
+  helper; the five copies of jsonata-js's `hofFuncArgs` argument shaping are two
+  helpers (`hof_array_call_args` for $map/$filter/$single, `hof_object_call_args` for
+  $sift/$each); the six copy-pasted encoding builtin arms share `unary_string_encoding`.
+  `signature.rs` dropped its dead `return_type` field and test-only constructors, and
+  a builtin signature that fails to parse now panics at cache build instead of leaving
+  that builtin silently unvalidated. `ast_transform.rs`'s 157-line module header — a
+  stale task journal whose ~20 line references were all wrong — is a 30-line statement
+  of the actual recursion/drop invariants, and `push_ast_node_children`'s leaf arm
+  lists every variant explicitly instead of `_ => {}`, so a future `AstNode` variant
+  cannot silently opt out of the stack-overflow-on-drop guard.
+- Five hand-maintained parallel lists of builtin names (the pure set, the arity table,
+  the compilable set, the signature table, and a test's own literal copy) are one
+  sorted `builtins::BUILTINS` spec table; `is_pure_builtin`, `is_compilable_builtin`,
+  `builtin_arity`, and `signature::builtin_signature` all derive from it, and the
+  jsonata-js fixture drift tests still police the data. Adding a builtin is now one
+  row plus its dispatch arm. Membership and values are unchanged (the table was
+  generated mechanically from the lists it replaces).
+- The bare-`AstNode::Name` arm of `evaluate_internal_impl` — a private field-access
+  copy that had drifted (kept nulls, never flattened, no tuple or lazy-dict handling)
+  and that instrumentation shows no expression in any suite reaches — now delegates
+  to `compiled_field_step`, the semantics owner for a single field step.
+
+### Deprecated
+
+### Removed
+- Repository hygiene: the checked-in `rustup-init.exe` (12.9 MB Windows installer that
+  dominated clone size and permanently tripped the file-size lint), the orphaned root
+  `node_modules/jsonata/` copy (~830 KB; nothing referenced it — the benchmark harness
+  installs its own under `benchmarks/javascript/`, and the reference implementation is the
+  `tests/jsonata-js` submodule), and the stale `src/parser/README.md` (every structural
+  claim in it — line counts, ranges, even the crate name in its example — was wrong).
+- Dead code that survived the 2.2.8 builtins consolidation: `functions::numeric::{max,
+  min, average}` and `functions::object::{keys, lookup}` had no callers and encoded
+  pre-#109 semantics the engine no longer has (`Null` instead of `Undefined` on empty
+  input, no nested-array recursion) — a trap for anyone fixing a `$max`/`$lookup` bug in
+  the wrong place. Their tests, which pinned the wrong behavior, went with them. Also
+  removed the unused `datetime::parse_iso8601`. Technically these were `pub` items of the
+  crate, so strict semver would call this a breaking change; they were never used by the
+  engine itself.
+
+### Fixed
+- Two families of tree-walker drift found by unifying the remaining field-extraction
+  loops onto `compiled_field_step` (each pinned on BOTH engines in
+  `tests/python/test_field_step_and_arraygroup.py` with jsonata-js reference outputs):
+  the single-step-Name fast path skipped null-valued fields and returned Null on empty
+  (`p` over `[{"p":null},{"p":2}]` was `2` on the tree-walker, `[null,2]` on the VM and
+  in the reference — the engines disagreed); and the `.[...]` array-group constructor
+  kept undefined elements as null (`foo.blah.[baz]` gave `[[..],[null],[null]]` instead
+  of `[[..],[],[]]`, masked downstream by that null-skip), while its empty results
+  conflated "constructed empty array over a single value" (kept: `{"a":1}.[b]` is `[]`)
+  with "mapped over an empty array" (undefined: `emptyarr.[b]`). Both tree-walker
+  Name-step loops (the fast path and the general step loop's inner loop) now delegate
+  to `compiled_field_step`, deleting ~100 lines of drifted copies; the reference
+  suite's `array-constructor/case013`/`case014` now pass by the correct route. The
+  fast path's tuple branch (a third copy, with the same null-skip drift) is deleted
+  outright — tuple streams fall through to the general step loop's single tuple
+  implementation, and `$#$i.p` over `[{"p":null},{"p":2}]` is now `[null,2]` on both
+  engines, matching the reference.
+- Errors carry their JSONata spec code at the front of the message again: the
+  `FunctionError` wrapping used to bury codes behind prose prefixes ("Runtime
+  error: D3030: Cannot convert 'x' to number"), so the C ABI, the Rust CLI, and
+  the Python CLI each grew a different classifier and disagreed on whether the
+  same error was coded. The inner message now passes through unwrapped
+  ("D3030: ..."), `EvaluatorError::code()` / `evaluator::error_code_prefix` is
+  the one definition of "coded error" (prefix-anchored), and the C ABI and both
+  CLIs classify with it — the same failure now presents identically in every
+  binary. The C ABI's mid-string code scan is retired (it existed only to see
+  through the now-removed prose prefixes).
+- Number stringification now matches jsonata-js exactly (verified against the pinned
+  reference with a 307-case randomized differential over scalars, containers,
+  prettified output, and `&` concatenation). Three divergences fixed: non-integers
+  were truncated to 14 significant digits instead of rounded to 15 (`$string(1/3)`
+  was `0.33333333333333`, now `0.333333333333333` — the old formatter counted the
+  `0` of a leading `0.` as significant); integer-valued floats above 2^53 printed
+  their exact i64 digits instead of the float's shortest round-trip decimal; and
+  numbers nested in containers went through serde with different rules again.
+  `$string` now stringifies through its own writer implementing the reference's
+  replacer (functions → `""`, non-integers → `toPrecision(15)`), and one
+  `value::js_number_to_string` defines JS number printing (plain digits in
+  [1e-6, 1e21), exponential with `+` outside, `-0` as `0`) for `$string`, concat,
+  `Display`, and `$join`. Pinned by `tests/python/test_number_stringification.py`.
+- `$var.field` over an array containing nested-array elements now recurses into
+  them like jsonata-js's `lookup`: `($v := [[{"p":1}],{"p":2}]; $v.p)` is `[1,2]`
+  (previously `2` — the tree-walker's two-step fast path hand-rolled its mapping
+  loop and silently skipped non-object elements; it now delegates to the shared
+  field step). Found while consolidating the seven divergent field-extraction
+  loops the cleanup review flagged; pinned by `tests/python/test_var_field_nested.py`.
+- Regex literals now honor the `m` (multiline) flag in `$match` and the `~>`
+  chain-pipe, matching `$split`/`$replace` and jsonata-js — the two paths
+  previously translated only `i` (see `tests/python/test_regex_flags.py`).
+
+### Security
+
 ## [2.2.8] "Conform-ata" - 2026-08-25
 
 Primarily a conformance release, with documentation work on the Rust crate alongside it. Most

{jsonatapy-2.2.8 → jsonatapy-2.2.9}/Cargo.lock

@@ -586,7 +586,7 @@ dependencies = [
 
 [[package]]
 name = "jsonata-core"
-version = "2.2.8"
+version = "2.2.9"
 dependencies = [
  "assert_cmd",
  "base64",
@@ -594,6 +594,7 @@ dependencies = [
  "clap",
  "criterion",
  "indexmap",
+ "mimalloc",
  "num-traits",
  "percent-encoding",
  "predicates",
@@ -614,6 +615,15 @@ version = "0.2.186"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "68ab91017fe16c622486840e4c83c9a37afeff978bd239b5293d61ece587de66"
 
+[[package]]
+name = "libmimalloc-sys"
+version = "0.1.49"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "6a45a52f43e1c16f667ccfe4dd8c85b7f7c204fd5e3bf46c5b0db9a5c3c0b8e9"
+dependencies = [
+ "cc",
+]
+
 [[package]]
 name = "linux-raw-sys"
 version = "0.12.1"
@@ -632,6 +642,15 @@ version = "2.8.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "cf8baf1c55e62ffcace7a9f06f4bd9cd3f0c4beb022d3b367256b91b87513d98"
 
+[[package]]
+name = "mimalloc"
+version = "0.1.52"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "2d4139bb28d14ad1facf21d5eb8825051b326e172d216b39f6d31df53cc97862"
+dependencies = [
+ "libmimalloc-sys",
+]
+
 [[package]]
 name = "normalize-line-endings"
 version = "0.3.0"

{jsonatapy-2.2.8 → jsonatapy-2.2.9}/Cargo.toml

@@ -1,6 +1,6 @@
 [package]
 name = "jsonata-core"
-version = "2.2.8"
+version = "2.2.9"
 edition = "2021"
 authors = ["txjmb <txjmb@users.noreply.github.com>"]
 description = "High-performance Rust implementation of JSONata query and transformation language"
@@ -29,7 +29,6 @@ exclude = [
     "CLAUDE.MD",
     "pyproject.toml",
     "uv.lock",
-    "rustup-init.exe",
 ]
 
 [lib]
@@ -56,6 +55,7 @@ rand = "0.10"
 stacker = "0.1"
 simd-json = { version = "0.18", optional = true }
 clap = { version = "4.6", features = ["derive"], optional = true }
+mimalloc = { version = "0.1.52", optional = true }
 
 [features]
 default = ["simd"]
@@ -64,6 +64,7 @@ python = ["dep:pyo3"]
 cli = ["dep:clap"]
 bench = []   # exposes _bench facade for Criterion benchmarks
 capi = []
+mimalloc = ["dep:mimalloc"]
 
 [dev-dependencies]
 criterion = "0.8"

{jsonatapy-2.2.8 → jsonatapy-2.2.9}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: jsonatapy
-Version: 2.2.8
+Version: 2.2.9
 Classifier: Development Status :: 5 - Production/Stable
 Classifier: Intended Audience :: Developers
 Classifier: License :: OSI Approved :: MIT License

{jsonatapy-2.2.8 → jsonatapy-2.2.9}/bindings/c/README.md

@@ -141,7 +141,13 @@ Rust library rebuilds with your project.)
    deliberately (e.g. a frozen `$now`, or a disabled `$eval`). `user_data`
    must outlive the handle. Registering a host function routes evaluation
    through the tree-walker, like variable bindings.
-8. **Panics:** internal engine panics are caught at the boundary and
+8. **Guardrails:** `jsonata_set_limits(expr, timeout_ms, max_stack_depth,
+   max_sequence_length)` bounds wall-clock time (D1012), AST recursion
+   depth (D1011), and query-result sequence length (D2015) for all
+   subsequent evaluations on that handle — the same three limits the
+   Python bindings expose. 0 means "unlimited" (the default); call again
+   to change or reset.
+9. **Panics:** internal engine panics are caught at the boundary and
    surface as errors prefixed `internal error:` — they will not abort
    your process.
 

{jsonatapy-2.2.8 → jsonatapy-2.2.9}/bindings/c/examples/smoke.c

@@ -112,6 +112,27 @@ int main(void) {
         jsonata_free_expr(e);
     }
 
+    /* evaluation guardrails */
+    {
+        JsonataExpr *e = jsonata_compile("$map([1..100000], function($x) { $x })");
+        CHECK(jsonata_set_limits(NULL, 0, 0, 0) == -1, "set_limits NULL handle -> -1");
+        CHECK(jsonata_set_limits(e, 0, 0, 10) == 0, "set_limits succeeds");
+        char *r = jsonata_evaluate(e, "{}");
+        char *err = take_error();
+        char *code = jsonata_last_error_code();
+        CHECK(r == NULL && err != NULL, "sequence limit -> NULL + message");
+        CHECK(code != NULL && strcmp(code, "D2015") == 0,
+              "sequence limit -> spec code D2015");
+        jsonata_free_string(err);
+        jsonata_free_string(code);
+        /* lifting the limit makes the same handle work again */
+        CHECK(jsonata_set_limits(e, 0, 0, 0) == 0, "set_limits reset succeeds");
+        char *r2 = jsonata_evaluate(e, "{}");
+        CHECK(r2 != NULL, "evaluate succeeds after limit reset");
+        jsonata_free_string(r2);
+        jsonata_free_expr(e);
+    }
+
     /* variable binding */
     {
         JsonataExpr *e = jsonata_compile("$sum($xs) + n");

{jsonatapy-2.2.8 → jsonatapy-2.2.9}/bindings/c/jsonata.h

@@ -110,6 +110,19 @@ int jsonata_register_fn(JsonataExpr *expr, const char *name,
 int jsonata_register_fn_override(JsonataExpr *expr, const char *name,
                                  jsonata_host_fn fn, void *user_data);
 
+/*
+ * Set evaluation guardrails, applied to every subsequent jsonata_evaluate()
+ * on this handle. Each limit uses 0 for "unlimited" (the default):
+ *   - timeout_ms          bounds wall-clock evaluation time (D1012 on breach)
+ *   - max_stack_depth     bounds AST recursion depth (D1011)
+ *   - max_sequence_length bounds query-result sequences (D2015)
+ * These are the same three guardrails the Python bindings expose.
+ * Returns 0 on success, -1 on a NULL handle (error slot set).
+ */
+int jsonata_set_limits(JsonataExpr *expr, unsigned long long timeout_ms,
+                       unsigned long long max_stack_depth,
+                       unsigned long long max_sequence_length);
+
 /* Free a handle returned by jsonata_compile(). NULL is a no-op. */
 void jsonata_free_expr(JsonataExpr *expr);
 

{jsonatapy-2.2.8 → jsonatapy-2.2.9}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "maturin"
 
 [project]
 name = "jsonatapy"
-version = "2.2.8"
+version = "2.2.9"
 description = "High-performance Python/Rust implementation of JSONata query and transformation language"
 authors = [
     {name = "txjmb", email = "txjmb@users.noreply.github.com"}
@@ -68,7 +68,7 @@ Repository = "https://github.com/txjmb/jsonata-core"
 [tool.maturin]
 python-source = "python"
 module-name = "jsonatapy._jsonatapy"
-features = ["pyo3/extension-module", "python"]
+features = ["pyo3/extension-module", "python", "mimalloc"]
 
 [dependency-groups]
 dev = [

{jsonatapy-2.2.8 → jsonatapy-2.2.9}/src/ast_transform.rs

@@ -3,150 +3,31 @@
 // (tests/jsonata-js/src/parser.js ~L937-1235), adapted to Rust's ownership
 // model: instead of mutating tree nodes in place, this consumes the raw
 // tree and rebuilds an enriched one with ancestor/tuple metadata resolved.
-
-// Recursion-depth safety (added: see docs/superpowers/plans/2026-07-07-parser-depth-and-u16-truncation-fixes-plan.md):
-// `parser::parse()` (src/parser.rs:1730) unconditionally pipes every parse
-// through `resolve_ancestry` below, so a deeply-nested input expression can
-// overflow the native stack here even though the raw Pratt parse itself
-// completed successfully -- confirmed empirically: a 200,000-term
-// left-nested arithmetic chain (`1+1+1+...`) SIGABRTs ("stack overflow")
-// via the full `parser::parse()` entry point, in this file, not the parser.
-//
-// There are THREE recursive pieces in this file, but only TWO independent
-// stack budgets: data flows one-way from resolve_ancestry into
-// transform_node/transform_children/transform_path_steps/
-// migrate_binding_markers ("cycle 1"), and separately into substitute_labels
-// ("cycle 2", a second full-tree walk that only starts after cycle 1 has
-// fully unwound -- see resolve_ancestry). walk_backward/seek_parent_step/
-// seek_parent_wrapped ("cycle 3") is reached FROM cycle 1 (transform_path_
-// steps's predicate/own-pending resolution, and transform_children's Sort
-// arm) while cycle 1's frames are still LIVE on the native stack -- it nests
-// ON TOP of cycle 1's depth rather than running after it -- so cycle 1 and
-// cycle 3 share one stack budget and their depths ADD, not two independent
-// caps. A depth guard that gives cycle 1 and cycle 3 each their own
-// independent counter capped at the native-safe limit would still allow
-// cap1 + cap3 frames live simultaneously and overflow; Task 2 needs ONE
-// counter threaded through cycle 1 AND cycle 3 together, and a SEPARATE
-// counter (reset to 0) for cycle 2 (substitute_labels), which only runs
-// after cycle 1/3's frames are gone. Guard all of the functions listed
-// below regardless of which cycle they're in -- checking depth in only one
-// cycle's functions is the exact "Task 5 pattern" (a check added at only
-// one of several recursive entry points) this task exists to avoid.
 //
-// (1) Main tree-transform mutual recursion -- depth scales with the general
-//     AST's nesting depth (binary op chains, block/array/function-arg
-//     nesting, parenthesized sub-paths used as a path step's node, etc.):
-//   - transform_node (:558) -- recurses directly (Path -> transform_path_steps;
-//     Block -> transform_node per element, a loop, but each iteration's call
-//     itself recurses; Binary{FocusBind/IndexBind} -> transform_node(lhs));
-//     for every other node kind, delegates to transform_children (still the
-//     same cycle). This is the actual site hit by the confirmed arithmetic-
-//     chain repro (`1+1+1+...` has no Path/`%` at all -- it's pure nested
-//     Binary, handled by transform_node's `other => transform_children(...)`
-//     fallback).
-//   - transform_children (:653) -- recurses via transform_node on every
-//     child of every composite node type (Binary lhs/rhs, Unary operand,
-//     Array/Function/Call-args/Object/ObjectTransform/Sort/Transform/
-//     ArrayGroup elements, Conditional branches, Lambda body, Predicate/
-//     FunctionApplication inner). This is the other function actually hit
-//     by the arithmetic-chain repro (Binary's lhs/rhs recursion).
-//   - transform_path_steps (:933) -- does NOT recurse on the flat
-//     `Vec<PathStep>` itself (that's a `for` loop over the steps -- bounded
-//     iteration, not stack depth; confirmed empirically in Step 3 below: a
-//     50,000-step flat dot-path parses fine). It DOES feed back into the
-//     cycle per-step: calls `migrate_binding_markers(step, ...)` for every
-//     step, and separately calls `transform_node` on each filter-stage
-//     expression. Depth here scales with how deeply a single step's OWN
-//     node is nested (e.g. a parenthesized sub-path `(Order.Product)` used
-//     as one step, itself containing another Path), not with the number of
-//     steps in the flat list.
-//   - migrate_binding_markers (:1224) -- not itself self-recursive (one
-//     match, each arm calls transform_node/splice_marker_steps once), but
-//     it's the edge that closes the transform_path_steps -> transform_node
-//     cycle, so it needs to participate in whatever depth-counter scheme
-//     Task 2 uses (thread it through, even if it never increments/checks
-//     independently of the transform_node call it makes).
+// ── Recursion-depth safety (the invariant this file must preserve) ──────────
 //
-// (2) substitute_labels (:273) -- self-recursive only (never calls
-//     transform_node/transform_children/transform_path_steps), structurally
-//     mirroring transform_children's per-node-type dispatch (every
-//     composite node type recurses into every child). Runs as a SECOND,
-//     separate full-tree walk after transform_node returns (see
-//     resolve_ancestry), so it needs its own depth counter/reset -- reusing
-//     a counter left over (at whatever depth) from pass (1) would be wrong.
+// `parser::parse()` pipes every parse through `resolve_ancestry`, so a deeply
+// nested input can overflow the native stack HERE even when the Pratt parse
+// succeeded (confirmed empirically with a 200,000-term `1+1+1+...` chain).
+// See docs/superpowers/plans/2026-07-07-parser-depth-and-u16-truncation-fixes-plan.md
+// for the full derivation. The rules, in short:
 //
-// (3) Ancestor-seek recursion, reached from pass (1) (transform_path_steps's
-//     predicate/own-pending resolution loop calling resolve_predicate_slot/
-//     walk_backward, and transform_children's Sort arm calling
-//     walk_backward directly) while pass (1)'s own frames are still live --
-//     it never calls back into transform_node/transform_children/
-//     transform_path_steps (a one-way bridge, not a mutual cycle with (1)),
-//     but because it nests ON TOP of (1)'s live stack rather than running
-//     after it unwinds, (1) and (3) share ONE stack budget (see the note
-//     above the fold -- their depths add). Depth here scales with how many
-//     levels of parenthesized sub-path nesting (`(...)` wrapping another
-//     `(...)`) a `%` reference has to walk through, not with path step
-//     count or general AST depth:
-//   - walk_backward (:1056) -- its own "while level > 0" loop walking
-//     backward through one `&mut [PathStep]` is bounded iteration (not a
-//     stack risk regardless of the slice's length), but it calls
-//     seek_parent_step per candidate step, which can call back into
-//     walk_backward (via seek_parent_wrapped's Path case) -- indirect
-//     recursion.
-//   - seek_parent_step (:1121) -- recurses via seek_parent_wrapped for the
-//     FunctionApplication and Block step-node cases (a parenthesized
-//     sub-path used as a step).
-//   - seek_parent_wrapped (:1191) -- recurses via walk_backward (Path case)
-//     AND directly calls itself (Block case, recursing into the block's
-//     last expression) -- e.g. doubly (or N-ly) nested parens.
-//   - resolve_predicate_slot (:1028) -- NOT part of this cycle itself (no
-//     self-loop; called once per predicate slot from transform_path_steps's
-//     loop over a bounded number of stages), but forwards into it
-//     (seek_parent_step / walk_backward), so its own frame sits at the
-//     base of chain (3) each time -- no guard needed in this function
-//     itself, but Task 2 should not assume the chain "starts" at
-//     walk_backward/seek_parent_step without going through here first in
-//     the predicate case.
+// 1. There are three recursive cycles but only TWO independent stack budgets.
+//    Cycle 1 (transform_node / transform_children / transform_path_steps /
+//    migrate_binding_markers) and cycle 3 (walk_backward / seek_parent_step /
+//    seek_parent_wrapped) nest on the SAME native stack — cycle 3 is reached
+//    while cycle 1's frames are live — so they must share ONE depth counter.
+//    Cycle 2 (substitute_labels) runs only after cycle 1 has fully unwound
+//    and gets its own counter.
 //
-// Functions confirmed NOT to need guarding (either non-recursive, or their
-// only "recursion" is bounded iteration over a Vec/HashMap-chain, not stack
-// depth):
-//   - coded (:161), AncestryState::new (:207), AncestryState::fresh_label
-//     (:214), Transformed::leaf (:243) -- trivial constructors/helpers, no
-//     recursive or child-node-walking calls at all.
-//   - AncestryState::canonical (:224) -- a `while let Some(...)` loop
-//     following an alias chain in a HashMap; iteration, not recursion, and
-//     the doc comment right above it already notes chains longer than one
-//     hop shouldn't arise in practice regardless.
-//   - apply_marker_to_step (:419), check_focus_bind_target (:454) -- single
-//     match/if-chain over already-computed values, no calls back into any
-//     tree-walking function.
-//   - splice_marker_steps (:486) -- loops over a `Vec<PathStep>` produced by
-//     an already-fully-transformed `Transformed` (its `steps`/`pending`
-//     inputs were recursed into by the CALLER before this runs), and over a
-//     small fixed-shape `while` popping trailing `Predicate` pseudo-steps;
-//     calls only check_focus_bind_target/apply_marker_to_step, never
-//     transform_node or itself.
-//   - wrap_marker_as_path (:545) -- calls splice_marker_steps once; no
-//     recursion, no self-loop.
-//   - resolve_ancestry (:252) -- the pass's entry point: calls
-//     transform_node exactly once, then substitute_labels exactly once.
-//     Not itself part of either cycle (never re-entered from within the
-//     tree walk it kicks off), so it doesn't need a depth CHECK, but Task 2
-//     should initialize/reset each of the three counters above here (one
-//     for cycle (1)+(shared edge into (3)), one for substitute_labels).
+// 2. Dropping an abandoned deep subtree recurses in the Drop glue,
+//    independently of any depth counter. Every owning bail-out (an `Err`
+//    return that still holds a subtree) must dismantle it iteratively via
+//    `push_ast_node_children`, never let it fall out of scope. That function
+//    deliberately has no `_` wildcard arm so a new AST variant cannot
+//    silently opt out.
 //
-// Step 3 sanity check performed (throwaway test, not committed): a
-// 200,000-step flat dot-path (`a.a.a...a`) -- same N as the crashing
-// arithmetic chain, for a clean apples-to-apples Ok-vs-crash comparison --
-// parsed via the FULL `parser::parse()` entry point returns `Ok`
-// immediately (iteration in transform_path_steps's `for step in steps`
-// loop, not recursion), while the 200,000-term arithmetic chain (`1+1+1+
-// ...`) still SIGABRTs ("stack overflow") via the same full `parser::
-// parse()` entry point in the same run -- confirming the root cause
-// identified in the prior session is still live in current code, and that
-// it's specifically recursion-on-nesting-depth (transform_children's
-// Binary arm), not merely "large input," that triggers it.
+// Functions are referenced by NAME throughout this file — line numbers rot.
 
 use crate::ast::{AstNode, BinaryOp, PathStep, Stage};
 use std::collections::HashMap;
@@ -388,11 +269,27 @@ fn push_ast_node_children(node: AstNode, stack: &mut Vec<AstNode>) {
             }
         }
         AstNode::FunctionApplication(inner) | AstNode::Predicate(inner) => stack.push(*inner),
-        // Leaf nodes (String/Name/Number/Boolean/Null/Undefined/Placeholder/
-        // Regex/Variable/ParentVariable/Wildcard/Descendant/Parent): no
-        // nested AstNode -- whatever's left of `node` (a String, an f64,
-        // ...) is dropped here for free, in O(1), as this match arm ends.
-        _ => {}
+        // Leaf nodes: no nested AstNode -- whatever's left of `node` (a
+        // String, an f64, ...) is dropped here for free, in O(1), as this
+        // match arm ends. Listed EXPLICITLY (no `_` wildcard) on purpose:
+        // this function is the stack-overflow-on-drop guard for abandoned
+        // deep subtrees, and a future variant holding a `Box<AstNode>` that
+        // fell into a wildcard would silently reintroduce the recursive-drop
+        // crash. A new variant must fail compilation here and be classified.
+        AstNode::String(_)
+        | AstNode::Name(_)
+        | AstNode::Number(_)
+        | AstNode::Boolean(_)
+        | AstNode::Null
+        | AstNode::Undefined
+        | AstNode::Placeholder
+        | AstNode::Regex { .. }
+        | AstNode::Variable(_)
+        | AstNode::ParentVariable(_)
+        | AstNode::Wildcard
+        | AstNode::Descendant
+        | AstNode::KeepArray
+        | AstNode::Parent(_) => {}
     }
 }
 

{jsonatapy-2.2.8 → jsonatapy-2.2.9}/src/bin/jsonata/error_format.rs

@@ -9,21 +9,13 @@ use jsonata_core::evaluator::EvaluatorError;
 /// callers use it directly.
 pub fn format_evaluator_error(e: &EvaluatorError) -> String {
     let msg = e.message();
-    if is_coded_error(msg) {
+    if e.code().is_some() {
         msg.to_string()
     } else {
         format!("error: {}", msg)
     }
 }
 
-fn is_coded_error(message: &str) -> bool {
-    let bytes = message.as_bytes();
-    bytes.len() >= 6
-        && matches!(bytes[0], b'T' | b'D' | b'U' | b'S')
-        && bytes[1..5].iter().all(u8::is_ascii_digit)
-        && bytes[5] == b':'
-}
-
 #[cfg(test)]
 mod tests {
     use super::*;