feat(eval): iterate object keys / values via ref source

Extends iterItems to handle JSON objects. New optional 'kind' field
on some / every (default 'keys') selects between iterating member
keys (yielded as Value.string) and member values.

Implementation uses an ItemIter union so we never allocate a
projected slice. This avoids threading an allocator through every
helper.

Deferred to follow-up PRs:
- 'kind: pairs' yielding [key, value] arrays needs an arena
  allocator handle in iterItems; add when the first allocating
  builtin (lower / upper) lands.
- 'in' shorthand desugar; pure parser-side change, no eval impact.

Release build grows by ~3KB (50K -> 53K).

Author: kanywst

src/ast.zig

@@ -48,13 +48,28 @@ pub const Expr = union(enum) {
         right: *const Expr,
     };
 
-    /// Iteration over an array or set. The evaluator binds each
-    /// element under `var_name` and runs `body`. `some` and `every`
-    /// share this shape; only the body combination differs.
+    /// Iteration over an array, set, or object. The evaluator binds
+    /// each element under `var_name` and runs `body`. `some` and
+    /// `every` share this shape; only the body combination differs.
+    ///
+    /// `kind` only matters when the source resolves to a JSON object;
+    /// for arrays and sets it is ignored.
     pub const Iter = struct {
         var_name: []const u8,
         source: *const Expr,
         body: *const Expr,
+        kind: IterKind = .keys,
+    };
+
+    pub const IterKind = enum {
+        keys,
+        values,
+
+        fn fromString(s: []const u8) ?IterKind {
+            if (std.mem.eql(u8, s, "keys")) return .keys;
+            if (std.mem.eql(u8, s, "values")) return .values;
+            return null;
+        }
     };
 
     /// Call to a builtin function. The evaluator looks `name` up in
@@ -200,10 +215,15 @@ pub fn buildExpr(allocator: std.mem.Allocator, node: Value) !*Expr {
         const var_name = try requireString(obj, "var");
         const source_v = try requireField(obj, "source");
         const body_v = try requireField(obj, "body");
+        const kind: Expr.IterKind = if (json.lookupMember(obj, "kind")) |k_v| blk: {
+            if (k_v != .string) return error.InvalidKind;
+            break :blk Expr.IterKind.fromString(k_v.string) orelse return error.UnknownKind;
+        } else .keys;
         const iter = Expr.Iter{
             .var_name = var_name,
             .source = try buildExpr(allocator, source_v),
             .body = try buildExpr(allocator, body_v),
+            .kind = kind,
         };
         expr.* = if (std.mem.eql(u8, t, "some"))
             .{ .some = iter }

src/eval.zig

@@ -165,52 +165,89 @@ fn evalCompare(
     };
 }
 
+/// Iterator handle returned by `iterItems`. Avoids allocating a
+/// projected `Value` slice for object iteration; the consumer reads
+/// elements through `len()` and `at()`.
+const ItemIter = union(enum) {
+    none,
+    flat: []const json.Value,
+    object_keys: []const json.Value.Member,
+    object_values: []const json.Value.Member,
+
+    fn len(self: ItemIter) usize {
+        return switch (self) {
+            .none => 0,
+            .flat => |xs| xs.len,
+            .object_keys, .object_values => |members| members.len,
+        };
+    }
+
+    fn at(self: ItemIter, i: usize) json.Value {
+        return switch (self) {
+            .none => unreachable,
+            .flat => |xs| xs[i],
+            .object_keys => |members| .{ .string = members[i].key },
+            .object_values => |members| members[i].value,
+        };
+    }
+};
+
 /// `some x in source: body`. True if the body holds for at least
-/// one binding.
+/// one binding. A non-iterable source yields `false`.
 fn evalSome(
     it: ast.Expr.Iter,
     input: json.Value,
     scope: ?*const Scope,
     depth: u32,
 ) HelperError!bool {
     if (depth >= max_eval_depth) return error.EvalTooDeep;
-    const items = try iterItems(it.source, input, scope, depth + 1) orelse return false;
-    for (items) |item| {
-        const child = Scope{ .parent = scope, .name = it.var_name, .bound = item };
+    const items = try iterItems(it.source, it.kind, input, scope, depth + 1);
+    if (items == .none) return false;
+    var i: usize = 0;
+    while (i < items.len()) : (i += 1) {
+        const child = Scope{ .parent = scope, .name = it.var_name, .bound = items.at(i) };
         if (try evalExprBool(it.body, input, &child, depth + 1)) return true;
     }
     return false;
 }
 
-/// `every x in source: body`. Vacuously true on an empty source.
+/// `every x in source: body`. Vacuously true on an empty or
+/// non-iterable source.
 fn evalEvery(
     it: ast.Expr.Iter,
     input: json.Value,
     scope: ?*const Scope,
     depth: u32,
 ) HelperError!bool {
     if (depth >= max_eval_depth) return error.EvalTooDeep;
-    const items = try iterItems(it.source, input, scope, depth + 1) orelse return true;
-    for (items) |item| {
-        const child = Scope{ .parent = scope, .name = it.var_name, .bound = item };
+    const items = try iterItems(it.source, it.kind, input, scope, depth + 1);
+    if (items == .none) return true;
+    var i: usize = 0;
+    while (i < items.len()) : (i += 1) {
+        const child = Scope{ .parent = scope, .name = it.var_name, .bound = items.at(i) };
         if (!try evalExprBool(it.body, input, &child, depth + 1)) return false;
     }
     return true;
 }
 
-/// Pull iterable items out of `source`. Returns `null` for
+/// Resolve `source` to an iterable view. Returns `.none` for
 /// non-iterable values; the caller decides the default.
 fn iterItems(
     source: *const ast.Expr,
+    kind: ast.Expr.IterKind,
     input: json.Value,
     scope: ?*const Scope,
     depth: u32,
-) HelperError!?[]const json.Value {
+) HelperError!ItemIter {
     const v = try resolveValue(source, input, scope, depth);
     return switch (v) {
-        .array => |xs| xs,
-        .set => |xs| xs,
-        else => null,
+        .array => |xs| .{ .flat = xs },
+        .set => |xs| .{ .flat = xs },
+        .object => |members| switch (kind) {
+            .keys => .{ .object_keys = members },
+            .values => .{ .object_values = members },
+        },
+        else => .none,
     };
 }
 
@@ -370,6 +407,51 @@ test "evaluate: unknown builtin denies" {
     try testing.expect(!(try run("{}", policy)));
 }
 
+test "evaluate: every over object keys" {
+    const policy =
+        "{\"type\":\"every\",\"var\":\"k\",\"kind\":\"keys\"," ++
+        "\"source\":{\"type\":\"ref\",\"path\":[\"input\",\"attrs\"]}," ++
+        "\"body\":{\"type\":\"neq\"," ++
+        "\"left\":{\"type\":\"ref\",\"path\":[\"k\"]}," ++
+        "\"right\":{\"type\":\"value\",\"value\":\"internal\"}}}";
+    try testing.expect(try run(
+        "{\"attrs\":{\"team\":\"sre\",\"region\":\"us-east\"}}",
+        policy,
+    ));
+    try testing.expect(!(try run(
+        "{\"attrs\":{\"team\":\"sre\",\"internal\":\"yes\"}}",
+        policy,
+    )));
+}
+
+test "evaluate: some over object values" {
+    const policy =
+        "{\"type\":\"some\",\"var\":\"v\",\"kind\":\"values\"," ++
+        "\"source\":{\"type\":\"ref\",\"path\":[\"input\",\"flags\"]}," ++
+        "\"body\":{\"type\":\"eq\"," ++
+        "\"left\":{\"type\":\"ref\",\"path\":[\"v\"]}," ++
+        "\"right\":{\"type\":\"value\",\"value\":true}}}";
+    try testing.expect(try run(
+        "{\"flags\":{\"a\":false,\"b\":true,\"c\":false}}",
+        policy,
+    ));
+    try testing.expect(!(try run(
+        "{\"flags\":{\"a\":false,\"b\":false}}",
+        policy,
+    )));
+}
+
+test "evaluate: every over object defaults to keys" {
+    const policy =
+        "{\"type\":\"every\",\"var\":\"k\"," ++
+        "\"source\":{\"type\":\"ref\",\"path\":[\"input\",\"m\"]}," ++
+        "\"body\":{\"type\":\"neq\"," ++
+        "\"left\":{\"type\":\"ref\",\"path\":[\"k\"]}," ++
+        "\"right\":{\"type\":\"value\",\"value\":\"banned\"}}}";
+    try testing.expect(try run("{\"m\":{\"x\":1,\"y\":2}}", policy));
+    try testing.expect(!(try run("{\"m\":{\"x\":1,\"banned\":2}}", policy)));
+}
+
 test "evaluate: every+some over arrays" {
     const policy =
         "{\"type\":\"every\",\"var\":\"req\"," ++