fix(#429): prevent SIGSEGV in buildPublishedRestResourceDef on malformed REST syntax

ANTLR error-recovery leaves STRING_LITERAL() nil when the publishedRestResource
rule cannot match (e.g. `end resource` keyword-style or missing opening brace).
The bare GetText() call on the nil token caused a SIGSEGV.

Add a nil guard at the top of buildPublishedRestResourceDef so it returns nil
instead of crashing. Guard both call sites (CREATE path and ALTER ADD RESOURCE
path) to skip nil results rather than appending them.

Regression test added: Build() on the exact crash input must not panic.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

Author: ako

mdl/visitor/visitor_rest.go

@@ -373,15 +373,21 @@ func (b *Builder) ExitCreatePublishedRestServiceStatement(ctx *parser.CreatePubl
 	// Parse resources
 	for _, resCtx := range ctx.AllPublishedRestResource() {
 		rc := resCtx.(*parser.PublishedRestResourceContext)
-		stmt.Resources = append(stmt.Resources, buildPublishedRestResourceDef(rc))
+		if res := buildPublishedRestResourceDef(rc); res != nil {
+			stmt.Resources = append(stmt.Resources, res)
+		}
 	}
 
 	b.statements = append(b.statements, stmt)
 }
 
 // buildPublishedRestResourceDef converts a PublishedRestResourceContext to a
 // PublishedRestResourceDef AST node. Shared by CREATE and ALTER.
+// Returns nil when the resource name token is absent (ANTLR error-recovery path).
 func buildPublishedRestResourceDef(rc *parser.PublishedRestResourceContext) *ast.PublishedRestResourceDef {
+	if rc.STRING_LITERAL() == nil {
+		return nil
+	}
 	resDef := &ast.PublishedRestResourceDef{
 		Name: unquoteString(rc.STRING_LITERAL().GetText()),
 	}
@@ -472,8 +478,9 @@ func (b *Builder) exitAlterPublishedRestServiceStatement(ctx *parser.AlterStatem
 		// ADD RESOURCE 'name' { ... }
 		if ac.ADD() != nil {
 			if rc := ac.PublishedRestResource(); rc != nil {
-				resDef := buildPublishedRestResourceDef(rc.(*parser.PublishedRestResourceContext))
-				stmt.Actions = append(stmt.Actions, &ast.PublishedRestAddResourceAction{Resource: resDef})
+				if resDef := buildPublishedRestResourceDef(rc.(*parser.PublishedRestResourceContext)); resDef != nil {
+					stmt.Actions = append(stmt.Actions, &ast.PublishedRestAddResourceAction{Resource: resDef})
+				}
 			}
 			continue
 		}

mdl/visitor/visitor_rest_test.go

@@ -88,3 +88,15 @@ func TestCreatePublishedRestService(t *testing.T) {
 		t.Errorf("Expected 2 operations, got %d", len(stmt.Resources[0].Operations))
 	}
 }
+
+// TestCreatePublishedRestService_EndResourceSyntax_NoPanic verifies that the
+// unsupported `end resource` keyword syntax does not cause a SIGSEGV (issue #429).
+// ANTLR error recovery produces a PublishedRestResourceContext with a nil
+// STRING_LITERAL token; the nil guard in buildPublishedRestResourceDef must
+// prevent the panic and let Build return without crashing.
+func TestCreatePublishedRestService_EndResourceSyntax_NoPanic(t *testing.T) {
+	input := "create published rest service MyModule.TestREST (Version: '1.0', Path: '/api') resource 'items' get '/all' microflow MyModule.GetItems; end resource;"
+	// Must not panic — parse errors are acceptable, a crash is not.
+	prog, _ := Build(input)
+	_ = prog
+}