symbios-shape 0.3.0

/// CGA Shape Grammar text parser.
///
/// Parses a sequence of operations in a grammar rule body:
///
/// ```text
/// Extrude(10)
/// Split(Y) { ~1: Floor | ~1: Floor | 2: Roof }
/// Comp(Faces) { Top: Roof | Side: Facade | Bottom: Foundation }
/// I("Window")
/// Mat("Brick")
/// ```
///
/// Stochastic rules use `weight%` syntax:
/// ```text
/// Facade --> 70% BrickWall | 30% GlassCurtain
/// ```
use nom::{
    IResult, Parser,
    branch::alt,
    bytes::complete::{tag, take_until, take_while, take_while_m_n, take_while1},
    character::complete::{char as c_char, multispace1},
    combinator::{cut, map, opt, verify},
    error::{Error, ErrorKind},
    multi::many0,
    number::complete::double,
    sequence::{delimited, preceded, terminated},
};

use crate::error::ShapeError;
use crate::expr::{Expr, MAX_EXPR_NODES, parse_expr};
use crate::ops::{
    AttachCase, AttachSelector, Axis, CarveCase, CarveSelector, CompFaceCase, CompTarget,
    FaceSelector, FitCandidate, OffsetCase, OffsetSelector, RoofCase, RoofFaceSelector, RoofSpec,
    RoofType, RuleCall, RuleVariant, ShapeOp, SplitEntry, SplitSize, SplitSlot, VariantSelector,
};
use crate::scope::Vec3;

// Safety limits (DoS protection)
const MAX_SPLIT_SLOTS: usize = 256;
const MAX_COMP_CASES: usize = 32;
const MAX_OPS: usize = 1024;
const MAX_IDENTIFIER_LEN: usize = 64;
/// Maximum number of stochastic variants in a single rule body (`A | B | C…`).
/// Without this cap an attacker can force unbounded `Vec` allocations in
/// `split_top_level_pipe` before any derivation-time guards can fire.
pub const MAX_VARIANTS: usize = 64;
/// Maximum number of call arguments on a rule reference (`Foo(a, b, …)`).
pub const MAX_RULE_ARGS: usize = 16;

// ── Whitespace & comments ────────────────────────────────────────────────────

pub(crate) fn space_or_comment<'a, E: nom::error::ParseError<&'a str>>(
    input: &'a str,
) -> IResult<&'a str, (), E> {
    let comment = alt((
        preceded(tag("/*"), terminated(take_until("*/"), tag("*/"))),
        // take_while (unlike is_not) accepts empty input, so `// EOF` without a
        // trailing newline parses correctly instead of returning a fatal error.
        preceded(tag("//"), take_while(|c: char| c != '\n' && c != '\r')),
    ));
    let mut p = many0(alt((map(multispace1, |_| ()), map(comment, |_| ()))));
    p.parse(input).map(|(i, _)| (i, ()))
}

fn ws<'a, F, O, E: nom::error::ParseError<&'a str>>(
    inner: F,
) -> impl Parser<&'a str, Output = O, Error = E>
where
    F: Parser<&'a str, Output = O, Error = E>,
{
    delimited(space_or_comment, inner, space_or_comment)
}

// ── Primitives ───────────────────────────────────────────────────────────────

fn finite_float(input: &str) -> IResult<&str, f64> {
    verify(double, |x: &f64| x.is_finite()).parse(input)
}

fn is_ident_start(c: char) -> bool {
    c.is_alphabetic() || c == '_'
}

fn is_ident_char(c: char) -> bool {
    c.is_alphanumeric() || c == '_'
}

pub(crate) fn identifier(input: &str) -> IResult<&str, &str> {
    let original = input;
    let (input, s) = take_while1(is_ident_char).parse(input)?;
    if !s.chars().next().map(is_ident_start).unwrap_or(false) {
        // Use `original` so the error span points to the start of the bad token,
        // not to the position after consuming it.
        return Err(nom::Err::Error(Error::new(original, ErrorKind::Alpha)));
    }
    if s.len() > MAX_IDENTIFIER_LEN {
        return Err(nom::Err::Failure(Error::new(input, ErrorKind::TooLarge)));
    }
    Ok((input, s))
}

/// Parses an identifier OR a quoted string literal `"name"`.
///
/// Quoted strings are limited to `MAX_IDENTIFIER_LEN` characters via
/// `take_while_m_n`: the scan stops at the limit, causing `c_char('"')` to
/// fail for oversized inputs before any allocation occurs.
fn rule_name(input: &str) -> IResult<&str, String> {
    alt((
        map(
            delimited(
                c_char('"'),
                take_while_m_n(0, MAX_IDENTIFIER_LEN, |c: char| c != '"'),
                c_char('"'),
            ),
            |s: &str| s.to_string(),
        ),
        map(ws(identifier), |s: &str| s.to_string()),
    ))
    .parse(input)
}

/// Consumes `kw` only when NOT followed by an identifier character — `I(`
/// matches, `Inner` falls through softly so the rule-reference fallback can
/// claim it. Without this any rule name sharing an op keyword's prefix dies
/// on the op parser's fatal `cut`.
fn keyword<'a>(
    kw: &'static str,
) -> impl FnMut(&'a str) -> IResult<&'a str, &'a str, Error<&'a str>> {
    move |input: &'a str| {
        let (rest, m) = tag::<_, _, Error<&str>>(kw).parse(input)?;
        if rest.chars().next().is_some_and(is_ident_char) {
            return Err(nom::Err::Error(Error::new(input, ErrorKind::Tag)));
        }
        Ok((rest, m))
    }
}

/// Parses an argument expression, enforcing the [`MAX_EXPR_NODES`] cap.
/// Every numeric argument position in the grammar routes through this.
fn arg_expr(input: &str) -> IResult<&str, Expr> {
    let (rest, e) = parse_expr(input)?;
    if e.node_count() > MAX_EXPR_NODES {
        return Err(nom::Err::Failure(Error::new(input, ErrorKind::TooLarge)));
    }
    Ok((rest, e))
}

/// Parses a rule reference with optional call arguments:
/// `Bay`, `"My Rule"`, or `Tier(depth + 1, 3)`.
///
/// Quoted names accept arguments too. The argument list is capped at
/// [`MAX_RULE_ARGS`].
fn parse_rule_call(input: &str) -> IResult<&str, RuleCall> {
    let (input, name) = rule_name(input)?;
    // Optional argument list. A bare reference is the common case.
    let Ok((mut rem, _)) = ws::<_, _, Error<&str>>(c_char('(')).parse(input) else {
        return Ok((input, RuleCall::new(name)));
    };
    let mut args = Vec::new();
    if let Ok((after, _)) = ws::<_, _, Error<&str>>(c_char(')')).parse(rem) {
        return Ok((after, RuleCall::with_args(name, args)));
    }
    loop {
        let (after_arg, arg) = arg_expr(rem)?;
        args.push(arg);
        if args.len() > MAX_RULE_ARGS {
            return Err(nom::Err::Failure(Error::new(
                after_arg,
                ErrorKind::TooLarge,
            )));
        }
        if let Ok((after, _)) = ws::<_, _, Error<&str>>(c_char(',')).parse(after_arg) {
            rem = after;
            continue;
        }
        let (after, _) = cut(ws(c_char(')'))).parse(after_arg)?;
        rem = after;
        break;
    }
    Ok((rem, RuleCall::with_args(name, args)))
}

// ── Axis ─────────────────────────────────────────────────────────────────────

fn parse_axis(input: &str) -> IResult<&str, Axis> {
    alt((
        map(tag("X"), |_| Axis::X),
        map(tag("Y"), |_| Axis::Y),
        map(tag("Z"), |_| Axis::Z),
    ))
    .parse(input)
}

// ── Vec3 / Quat expression tuples ────────────────────────────────────────────

/// Parses `(x, y, z)` where each component is an argument expression.
fn parse_expr3(input: &str) -> IResult<&str, [Expr; 3]> {
    let (input, _) = ws(c_char('(')).parse(input)?;
    let (input, x) = arg_expr(input)?;
    let (input, _) = ws(c_char(',')).parse(input)?;
    let (input, y) = arg_expr(input)?;
    let (input, _) = ws(c_char(',')).parse(input)?;
    let (input, z) = arg_expr(input)?;
    let (input, _) = ws(c_char(')')).parse(input)?;
    Ok((input, [x, y, z]))
}

/// Parses `(w, x, y, z)` — grammar order is (w,x,y,z); evaluation converts to
/// glam's (x,y,z,w) and normalizes. When all four components are literals the
/// degenerate-quaternion check runs at parse time for early feedback.
fn parse_expr4(input: &str) -> IResult<&str, [Expr; 4]> {
    let (input, _) = ws(c_char('(')).parse(input)?;
    let (input, w) = arg_expr(input)?;
    let (input, _) = ws(c_char(',')).parse(input)?;
    let (input, x) = arg_expr(input)?;
    let (input, _) = ws(c_char(',')).parse(input)?;
    let (input, y) = arg_expr(input)?;
    let (input, _) = ws(c_char(',')).parse(input)?;
    let (input, z) = arg_expr(input)?;
    let (input, _) = ws(c_char(')')).parse(input)?;
    if let (Some(wv), Some(xv), Some(yv), Some(zv)) =
        (w.as_lit(), x.as_lit(), y.as_lit(), z.as_lit())
    {
        let len_sq = xv * xv + yv * yv + zv * zv + wv * wv;
        if !len_sq.is_finite() || len_sq < 1e-12 {
            return Err(nom::Err::Failure(Error::new(input, ErrorKind::Verify)));
        }
    }
    Ok((input, [w, x, y, z]))
}

// ── Split sizes ───────────────────────────────────────────────────────────────

/// `~2.5` → `Floating`, `'0.5` → `Relative`, `2.5` / `scope.x - 4` → `Absolute`.
/// Sizes are expressions; the interpreter validates the evaluated values.
fn parse_split_size(input: &str) -> IResult<&str, SplitSize> {
    if let Ok((rest, _)) = c_char::<_, Error<&str>>('~').parse(input) {
        let (rest, e) = arg_expr(rest)?;
        return Ok((rest, SplitSize::Floating(e)));
    }
    if let Ok((rest, _)) = c_char::<_, Error<&str>>('\'').parse(input) {
        let (rest, e) = arg_expr(rest)?;
        return Ok((rest, SplitSize::Relative(e)));
    }
    let (rest, e) = arg_expr(input)?;
    Ok((rest, SplitSize::Absolute(e)))
}

/// `~1.0: Floor` or `2.0: Roof(depth + 1)`
fn parse_split_slot(input: &str) -> IResult<&str, SplitSlot> {
    let (input, size) = ws(parse_split_size).parse(input)?;
    let (input, _) = ws(c_char(':')).parse(input)?;
    let (input, rule) = ws(parse_rule_call).parse(input)?;
    Ok((input, SplitSlot { size, rule }))
}

// ── Comp faces ────────────────────────────────────────────────────────────────

fn parse_comp_face_case(input: &str) -> IResult<&str, CompFaceCase> {
    let (input, sel_str) = ws(identifier).parse(input)?;
    let selector = FaceSelector::parse(sel_str)
        .ok_or_else(|| nom::Err::Failure(Error::new(input, ErrorKind::Tag)))?;
    let (input, _) = ws(c_char(':')).parse(input)?;
    let (input, rule) = ws(parse_rule_call).parse(input)?;
    Ok((input, CompFaceCase { selector, rule }))
}

// ── Individual operations ─────────────────────────────────────────────────────

fn parse_extrude(input: &str) -> IResult<&str, ShapeOp> {
    let (input, _) = keyword("Extrude")(input)?;
    let (input, h) = cut(delimited(ws(c_char('(')), arg_expr, ws(c_char(')')))).parse(input)?;
    // Early feedback for literal arguments; expression results are validated
    // at derivation time.
    if let Some(v) = h.as_lit()
        && v <= 0.0
    {
        return Err(nom::Err::Failure(Error::new(input, ErrorKind::Verify)));
    }
    Ok((input, ShapeOp::Extrude(h)))
}

fn parse_taper(input: &str) -> IResult<&str, ShapeOp> {
    let (input, _) = keyword("Taper")(input)?;
    let (input, amount) =
        cut(delimited(ws(c_char('(')), arg_expr, ws(c_char(')')))).parse(input)?;
    if let Some(v) = amount.as_lit()
        && !(0.0..=1.0).contains(&v)
    {
        return Err(nom::Err::Failure(Error::new(input, ErrorKind::Verify)));
    }
    Ok((input, ShapeOp::Taper(amount)))
}

fn parse_rotate(input: &str) -> IResult<&str, ShapeOp> {
    let (input, _) = keyword("Rotate")(input)?;
    let (input, q) = cut(ws(parse_expr4)).parse(input)?;
    Ok((input, ShapeOp::Rotate(q)))
}

fn parse_translate(input: &str) -> IResult<&str, ShapeOp> {
    let (input, _) = keyword("Translate")(input)?;
    let (input, v) = cut(ws(parse_expr3)).parse(input)?;
    Ok((input, ShapeOp::Translate(v)))
}

fn parse_scale(input: &str) -> IResult<&str, ShapeOp> {
    let (input, _) = keyword("Scale")(input)?;
    let (input, v) = cut(ws(parse_expr3)).parse(input)?;
    for c in &v {
        if let Some(lit) = c.as_lit()
            && lit <= 0.0
        {
            return Err(nom::Err::Failure(Error::new(input, ErrorKind::Verify)));
        }
    }
    Ok((input, ShapeOp::Scale(v)))
}

/// Parses `snap="label"` or `snap="label", tol=0.5` named arguments inside
/// `Split(axis, …)`. Returns the optional `SnapBinding` and the `tol` value
/// stored on it (or `None` for the default).
fn parse_split_snap(input: &str) -> IResult<&str, Option<crate::ops::SnapBinding>> {
    // Expect a leading comma. If absent, no snap.
    let Ok((after_comma, _)) = ws::<_, _, Error<&str>>(c_char(',')).parse(input) else {
        return Ok((input, None));
    };
    let Ok((after_eq, _)) = (
        ws::<_, _, Error<&str>>(tag("snap")),
        ws::<_, _, Error<&str>>(c_char('=')),
    )
        .parse(after_comma)
    else {
        return Ok((input, None));
    };
    let (after_label, label) = cut(ws(rule_name)).parse(after_eq)?;
    // Optional `, tol=N`.
    let mut remaining = after_label;
    let mut tolerance: Option<f64> = None;
    if let Ok((after_c, _)) = ws::<_, _, Error<&str>>(c_char(',')).parse(remaining)
        && let Ok((after_t_eq, _)) = (
            ws::<_, _, Error<&str>>(tag("tol")),
            ws::<_, _, Error<&str>>(c_char('=')),
        )
            .parse(after_c)
    {
        let (after_v, v) = cut(ws(finite_float)).parse(after_t_eq)?;
        if v < 0.0 {
            return Err(nom::Err::Failure(Error::new(after_v, ErrorKind::Verify)));
        }
        tolerance = Some(v);
        remaining = after_v;
    }
    Ok((
        remaining,
        Some(crate::ops::SnapBinding { label, tolerance }),
    ))
}

/// Parses a rhythm group `{ slot | slot }*` inside a `Split` body.
fn parse_split_group(input: &str) -> IResult<&str, Vec<SplitSlot>> {
    let (input, _) = ws(c_char('{')).parse(input)?;
    let (mut remaining, first) = cut(ws(parse_split_slot)).parse(input)?;
    let mut slots = vec![first];
    loop {
        if slots.len() >= MAX_SPLIT_SLOTS {
            return Err(nom::Err::Failure(Error::new(
                remaining,
                ErrorKind::TooLarge,
            )));
        }
        let Ok((after_sep, _)) = ws::<_, _, Error<&str>>(c_char('|')).parse(remaining) else {
            break;
        };
        let (after_item, slot) = cut(ws(parse_split_slot)).parse(after_sep)?;
        slots.push(slot);
        remaining = after_item;
    }
    let (remaining, _) = cut(ws(c_char('}'))).parse(remaining)?;
    let (remaining, _) = cut(ws(c_char('*'))).parse(remaining)?;
    Ok((remaining, slots))
}

/// One `Split` entry: a rhythm group or a single slot.
fn parse_split_entry(input: &str) -> IResult<&str, SplitEntry> {
    if input.trim_start().starts_with('{') {
        let (rest, group) = parse_split_group(input)?;
        return Ok((rest, SplitEntry::Group(group)));
    }
    let (rest, slot) = parse_split_slot(input)?;
    Ok((rest, SplitEntry::Slot(slot)))
}

fn parse_split(input: &str) -> IResult<&str, ShapeOp> {
    let (input, _) = keyword("Split")(input)?;
    // After the "Split" keyword is consumed, any argument error is fatal.
    let (input, _) = cut(ws(c_char('('))).parse(input)?;
    let (input, axis) = cut(ws(parse_axis)).parse(input)?;
    let (input, snap) = parse_split_snap(input)?;
    let (input, _) = cut(ws(c_char(')'))).parse(input)?;
    let (input, _) = cut(ws(c_char('{'))).parse(input)?;
    // Bounded list: cap allocation before it happens (DoS guard).
    let (mut remaining, first) = cut(ws(parse_split_entry)).parse(input)?;
    let mut entries = vec![first];
    loop {
        if entries.len() >= MAX_SPLIT_SLOTS {
            return Err(nom::Err::Failure(Error::new(
                remaining,
                ErrorKind::TooLarge,
            )));
        }
        let Ok((after_sep, _)) = ws::<_, _, Error<&str>>(c_char('|')).parse(remaining) else {
            break;
        };
        match ws(parse_split_entry).parse(after_sep) {
            Ok((after_item, entry)) => {
                entries.push(entry);
                remaining = after_item;
            }
            Err(nom::Err::Failure(e)) => return Err(nom::Err::Failure(e)),
            Err(_) => {
                remaining = after_sep; // trailing `|` — consume separator, stop
                break;
            }
        }
    }
    let (remaining, _) = ws(c_char('}')).parse(remaining)?;
    // One rhythm group per split keeps allocation predictable.
    if entries
        .iter()
        .filter(|e| matches!(e, SplitEntry::Group(_)))
        .count()
        > 1
    {
        return Err(nom::Err::Failure(Error::new(remaining, ErrorKind::Verify)));
    }
    Ok((
        remaining,
        ShapeOp::Split {
            axis,
            entries,
            snap,
        },
    ))
}

/// `SplitArea(X) { 30: Lot | ~1: Rest }` — split by target areas.
fn parse_split_area(input: &str) -> IResult<&str, ShapeOp> {
    let (input, _) = keyword("SplitArea")(input)?;
    let (input, _) = cut(ws(c_char('('))).parse(input)?;
    let (input, axis) = cut(ws(parse_axis)).parse(input)?;
    if axis == Axis::Y {
        return Err(nom::Err::Failure(Error::new(input, ErrorKind::Verify)));
    }
    let (input, _) = cut(ws(c_char(')'))).parse(input)?;
    let (input, _) = cut(ws(c_char('{'))).parse(input)?;
    let (mut remaining, first) = cut(ws(parse_split_slot)).parse(input)?;
    let mut slots = vec![first];
    loop {
        if slots.len() >= MAX_SPLIT_SLOTS {
            return Err(nom::Err::Failure(Error::new(
                remaining,
                ErrorKind::TooLarge,
            )));
        }
        let Ok((after_sep, _)) = ws::<_, _, Error<&str>>(c_char('|')).parse(remaining) else {
            break;
        };
        let (after_item, slot) = cut(ws(parse_split_slot)).parse(after_sep)?;
        slots.push(slot);
        remaining = after_item;
    }
    let (remaining, _) = ws(c_char('}')).parse(remaining)?;
    Ok((remaining, ShapeOp::SplitArea { axis, slots }))
}

/// `Fit(X) { 2.2: DoorBay | 1.2: WinBay | 0: Wall }` — first candidate whose
/// minimum extent fits the scope wins the whole scope.
fn parse_fit(input: &str) -> IResult<&str, ShapeOp> {
    let (input, _) = keyword("Fit")(input)?;
    let (input, _) = cut(ws(c_char('('))).parse(input)?;
    let (input, axis) = cut(ws(parse_axis)).parse(input)?;
    let (input, _) = cut(ws(c_char(')'))).parse(input)?;
    let (input, _) = cut(ws(c_char('{'))).parse(input)?;
    let mut candidates = Vec::new();
    let mut remaining = input;
    loop {
        if candidates.len() >= MAX_SPLIT_SLOTS {
            return Err(nom::Err::Failure(Error::new(
                remaining,
                ErrorKind::TooLarge,
            )));
        }
        let (after_min, min_size) = cut(ws(arg_expr)).parse(remaining)?;
        let (after_colon, _) = cut(ws(c_char(':'))).parse(after_min)?;
        let (after_rule, rule) = cut(ws(parse_rule_call)).parse(after_colon)?;
        candidates.push(FitCandidate { min_size, rule });
        if let Ok((after_sep, _)) = ws::<_, _, Error<&str>>(c_char('|')).parse(after_rule) {
            remaining = after_sep;
            continue;
        }
        remaining = after_rule;
        break;
    }
    let (remaining, _) = cut(ws(c_char('}'))).parse(remaining)?;
    Ok((remaining, ShapeOp::Fit { axis, candidates }))
}

/// `RegSnap("label")` — registers all six face planes of the current scope.
fn parse_reg_snap(input: &str) -> IResult<&str, ShapeOp> {
    let (input, _) = keyword("RegSnap")(input)?;
    let (input, _) = cut(ws(c_char('('))).parse(input)?;
    let (input, label) = cut(ws(rule_name)).parse(input)?;
    let (input, _) = cut(ws(c_char(')'))).parse(input)?;
    Ok((input, ShapeOp::RegSnap(label)))
}

/// Optional `("label")` filter between an occlusion keyword and its brace.
fn parse_occlusion_label(input: &str) -> IResult<&str, Option<String>> {
    let Ok((rest, _)) = ws::<_, _, Error<&str>>(c_char('(')).parse(input) else {
        return Ok((input, None));
    };
    let (rest, label) = cut(ws(rule_name)).parse(rest)?;
    let (rest, _) = cut(ws(c_char(')'))).parse(rest)?;
    Ok((rest, Some(label)))
}

/// Shared body for the four occlusion conditionals.
fn parse_occlusion_body(input: &str) -> IResult<&str, (RuleCall, Option<String>)> {
    let (input, label) = parse_occlusion_label(input)?;
    let (input, _) = cut(ws(c_char('{'))).parse(input)?;
    let (input, rule) = cut(ws(parse_rule_call)).parse(input)?;
    let (input, _) = cut(ws(c_char('}'))).parse(input)?;
    Ok((input, (rule, label)))
}

/// `IfClear { Rule }` / `IfClear("label") { Rule }`.
fn parse_if_clear(input: &str) -> IResult<&str, ShapeOp> {
    let (input, _) = keyword("IfClear")(input)?;
    let (input, (rule, label)) = parse_occlusion_body(input)?;
    Ok((input, ShapeOp::IfClear { rule, label }))
}

/// `IfOccluded { Rule }` / `IfOccluded("label") { Rule }`.
fn parse_if_occluded(input: &str) -> IResult<&str, ShapeOp> {
    let (input, _) = keyword("IfOccluded")(input)?;
    let (input, (rule, label)) = parse_occlusion_body(input)?;
    Ok((input, ShapeOp::IfOccluded { rule, label }))
}

/// `IfInside { Rule }` / `IfInside("label") { Rule }`.
fn parse_if_inside(input: &str) -> IResult<&str, ShapeOp> {
    let (input, _) = keyword("IfInside")(input)?;
    let (input, (rule, label)) = parse_occlusion_body(input)?;
    Ok((input, ShapeOp::IfInside { rule, label }))
}

/// `IfTouches { Rule }` / `IfTouches("label") { Rule }`.
fn parse_if_touches(input: &str) -> IResult<&str, ShapeOp> {
    let (input, _) = keyword("IfTouches")(input)?;
    let (input, (rule, label)) = parse_occlusion_body(input)?;
    Ok((input, ShapeOp::IfTouches { rule, label }))
}

/// `Label("chimneys")` — stamps an occlusion label on this branch.
fn parse_label(input: &str) -> IResult<&str, ShapeOp> {
    let (input, _) = keyword("Label")(input)?;
    let (input, _) = cut(ws(c_char('('))).parse(input)?;
    let (input, label) = cut(ws(rule_name)).parse(input)?;
    let (input, _) = cut(ws(c_char(')'))).parse(input)?;
    Ok((input, ShapeOp::Label(label)))
}

/// `Pick("key") { 60% A | 40% B }` — derivation-coherent weighted choice.
fn parse_pick(input: &str) -> IResult<&str, ShapeOp> {
    let (input, _) = keyword("Pick")(input)?;
    let (input, _) = cut(ws(c_char('('))).parse(input)?;
    let (input, key) = cut(ws(rule_name)).parse(input)?;
    let (input, _) = cut(ws(c_char(')'))).parse(input)?;
    let (input, _) = cut(ws(c_char('{'))).parse(input)?;
    let mut choices = Vec::new();
    let mut remaining = input;
    loop {
        if choices.len() >= MAX_VARIANTS {
            return Err(nom::Err::Failure(Error::new(
                remaining,
                ErrorKind::TooLarge,
            )));
        }
        let (after_w, w) = cut(ws(parse_weight_prefix)).parse(remaining)?;
        if !w.is_finite() || w < 0.0 {
            return Err(nom::Err::Failure(Error::new(after_w, ErrorKind::Verify)));
        }
        let (after_rule, rule) = cut(ws(parse_rule_call)).parse(after_w)?;
        choices.push((w / 100.0, rule));
        if let Ok((after_sep, _)) = ws::<_, _, Error<&str>>(c_char('|')).parse(after_rule) {
            remaining = after_sep;
            continue;
        }
        remaining = after_rule;
        break;
    }
    let (remaining, _) = cut(ws(c_char('}'))).parse(remaining)?;
    Ok((remaining, ShapeOp::Pick { key, choices }))
}

/// `Scatter(Top, 12) { Bush }` / `Scatter(Volume, n * 2) { Mote }`.
fn parse_scatter(input: &str) -> IResult<&str, ShapeOp> {
    let (input, _) = keyword("Scatter")(input)?;
    let (input, _) = cut(ws(c_char('('))).parse(input)?;
    let (input, kind) = cut(ws(identifier)).parse(input)?;
    let volume = match kind {
        "Top" | "top" => false,
        "Volume" | "volume" => true,
        _ => return Err(nom::Err::Failure(Error::new(input, ErrorKind::Tag))),
    };
    let (input, _) = cut(ws(c_char(','))).parse(input)?;
    let (input, count) = cut(arg_expr).parse(input)?;
    let (input, _) = cut(ws(c_char(')'))).parse(input)?;
    let (input, _) = cut(ws(c_char('{'))).parse(input)?;
    let (input, rule) = cut(ws(parse_rule_call)).parse(input)?;
    let (input, _) = cut(ws(c_char('}'))).parse(input)?;
    Ok((
        input,
        ShapeOp::Scatter {
            volume,
            count,
            rule,
        },
    ))
}

/// Cap on the number of entries in a `Repeat(axis, [..])` tile-size list.
/// Bounds parser allocation; matches `MAX_SPLIT_SLOTS`-style DoS hardening.
const MAX_REPEAT_TILE_SIZES: usize = 256;

/// Rejects a literal tile size that is not strictly positive; expression
/// sizes are validated on their evaluated values at derivation time.
fn check_tile_lit<'a>(e: &Expr, at: &'a str) -> Result<(), nom::Err<Error<&'a str>>> {
    if let Some(v) = e.as_lit()
        && v <= 0.0
    {
        return Err(nom::Err::Failure(Error::new(at, ErrorKind::Verify)));
    }
    Ok(())
}

/// Parses `Repeat`'s tile-size argument as either a single expression
/// (`Repeat(X, 2.5)` — uniform) or a bracketed list
/// (`Repeat(X, [2, 1.5, 3])` — cycled pattern).
fn parse_repeat_tile_sizes(input: &str) -> IResult<&str, Vec<Expr>> {
    // Try the bracketed list first.
    if let Ok((rest, _)) = ws::<_, _, Error<&str>>(c_char('[')).parse(input) {
        let (rest, first) = cut(arg_expr).parse(rest)?;
        check_tile_lit(&first, rest)?;
        let mut sizes = vec![first];
        let mut remaining = rest;
        loop {
            if sizes.len() >= MAX_REPEAT_TILE_SIZES {
                return Err(nom::Err::Failure(Error::new(
                    remaining,
                    ErrorKind::TooLarge,
                )));
            }
            let Ok((after_comma, _)) = ws::<_, _, Error<&str>>(c_char(',')).parse(remaining) else {
                break;
            };
            let (after_num, v) = cut(arg_expr).parse(after_comma)?;
            check_tile_lit(&v, after_num)?;
            sizes.push(v);
            remaining = after_num;
        }
        let (remaining, _) = cut(ws(c_char(']'))).parse(remaining)?;
        return Ok((remaining, sizes));
    }
    // Fallback: single expression.
    let (rest, v) = arg_expr(input)?;
    check_tile_lit(&v, rest)?;
    Ok((rest, vec![v]))
}

fn parse_repeat(input: &str) -> IResult<&str, ShapeOp> {
    let (input, _) = keyword("Repeat")(input)?;
    // After the "Repeat" keyword is consumed, any argument error is fatal.
    let (input, _) = cut(ws(c_char('('))).parse(input)?;
    let (input, axis) = cut(ws(parse_axis)).parse(input)?;
    let (input, _) = cut(ws(c_char(','))).parse(input)?;
    let (input, tile_sizes) = cut(parse_repeat_tile_sizes).parse(input)?;
    let (input, _) = cut(ws(c_char(')'))).parse(input)?;
    let (input, _) = cut(ws(c_char('{'))).parse(input)?;
    let (input, rule) = cut(ws(parse_rule_call)).parse(input)?;
    let (input, _) = cut(ws(c_char('}'))).parse(input)?;
    Ok((
        input,
        ShapeOp::Repeat {
            axis,
            tile_sizes,
            rule,
        },
    ))
}

fn parse_comp_edge_case(input: &str) -> IResult<&str, crate::ops::CompEdgeCase> {
    let (input, sel_str) = ws(identifier).parse(input)?;
    let selector = crate::ops::EdgeSelector::parse(sel_str)
        .ok_or_else(|| nom::Err::Failure(Error::new(input, ErrorKind::Tag)))?;
    let (input, _) = ws(c_char(':')).parse(input)?;
    let (input, rule) = ws(parse_rule_call).parse(input)?;
    Ok((input, crate::ops::CompEdgeCase { selector, rule }))
}

fn parse_comp(input: &str) -> IResult<&str, ShapeOp> {
    let (input, _) = keyword("Comp")(input)?;
    // After the "Comp" keyword is consumed, any argument error is fatal.
    let (input, _) = cut(ws(c_char('('))).parse(input)?;
    let (input, kind) = cut(ws(identifier)).parse(input)?;
    let edges = match kind {
        "Faces" | "faces" => false,
        "Edges" | "edges" => true,
        _ => return Err(nom::Err::Failure(Error::new(input, ErrorKind::Tag))),
    };
    let (input, _) = cut(ws(c_char(')'))).parse(input)?;
    let (input, _) = cut(ws(c_char('{'))).parse(input)?;
    if edges {
        let (mut remaining, first) = cut(ws(parse_comp_edge_case)).parse(input)?;
        let mut cases = vec![first];
        loop {
            if cases.len() >= MAX_COMP_CASES {
                return Err(nom::Err::Failure(Error::new(
                    remaining,
                    ErrorKind::TooLarge,
                )));
            }
            let Ok((after_sep, _)) = ws::<_, _, Error<&str>>(c_char('|')).parse(remaining) else {
                break;
            };
            match ws(parse_comp_edge_case).parse(after_sep) {
                Ok((after_item, case)) => {
                    cases.push(case);
                    remaining = after_item;
                }
                Err(nom::Err::Failure(e)) => return Err(nom::Err::Failure(e)),
                Err(_) => {
                    remaining = after_sep;
                    break;
                }
            }
        }
        let (remaining, _) = ws(c_char('}')).parse(remaining)?;
        return Ok((remaining, ShapeOp::Comp(CompTarget::Edges(cases))));
    }
    // Bounded list: cap allocation before it happens (DoS guard).
    let (mut remaining, first) = cut(ws(parse_comp_face_case)).parse(input)?;
    let mut cases = vec![first];
    loop {
        if cases.len() >= MAX_COMP_CASES {
            return Err(nom::Err::Failure(Error::new(
                remaining,
                ErrorKind::TooLarge,
            )));
        }
        let Ok((after_sep, _)) = ws::<_, _, Error<&str>>(c_char('|')).parse(remaining) else {
            break;
        };
        match ws(parse_comp_face_case).parse(after_sep) {
            Ok((after_item, case)) => {
                cases.push(case);
                remaining = after_item;
            }
            Err(nom::Err::Failure(e)) => return Err(nom::Err::Failure(e)),
            Err(_) => {
                remaining = after_sep; // trailing `|` — consume separator, stop
                break;
            }
        }
    }
    let (remaining, _) = ws(c_char('}')).parse(remaining)?;
    Ok((remaining, ShapeOp::Comp(CompTarget::Faces(cases))))
}

fn parse_instance(input: &str) -> IResult<&str, ShapeOp> {
    let (input, _) = tag::<_, _, Error<&str>>("I").parse(input)?;
    // `I` must be the whole keyword: `Inner` is a rule reference.
    if input.chars().next().is_some_and(is_ident_char) {
        return Err(nom::Err::Error(Error::new(input, ErrorKind::Tag)));
    }
    let (input, mesh_id) =
        cut(delimited(ws(c_char('(')), ws(rule_name), ws(c_char(')')))).parse(input)?;
    Ok((input, ShapeOp::I(mesh_id)))
}

/// Cap on the vertex count of a `Polygon(...)` op (DoS hardening).
const MAX_POLYGON_VERTICES: usize = 256;

/// Parses `Polygon((0,0), (4,0), (4,2), (2,2), (2,4), (0,4))` — a variadic
/// list of at least 3 `(x, y)` 2-D points. Each point is parsed with
/// `parse_vec2`; non-finite components are rejected by `finite_float`.
fn parse_vec2(input: &str) -> IResult<&str, glam::DVec2> {
    let (input, _) = ws(c_char('(')).parse(input)?;
    let (input, x) = ws(finite_float).parse(input)?;
    let (input, _) = ws(c_char(',')).parse(input)?;
    let (input, y) = ws(finite_float).parse(input)?;
    let (input, _) = ws(c_char(')')).parse(input)?;
    Ok((input, glam::DVec2::new(x, y)))
}

fn parse_polygon(input: &str) -> IResult<&str, ShapeOp> {
    let (input, _) = keyword("Polygon")(input)?;
    let (input, _) = cut(ws(c_char('('))).parse(input)?;
    let (input, first) = cut(ws(parse_vec2)).parse(input)?;
    let mut verts = vec![first];
    let mut remaining = input;
    loop {
        if verts.len() >= MAX_POLYGON_VERTICES {
            return Err(nom::Err::Failure(Error::new(
                remaining,
                ErrorKind::TooLarge,
            )));
        }
        let Ok((after_comma, _)) = ws::<_, _, Error<&str>>(c_char(',')).parse(remaining) else {
            break;
        };
        let (after_pt, pt) = cut(ws(parse_vec2)).parse(after_comma)?;
        verts.push(pt);
        remaining = after_pt;
    }
    let (remaining, _) = cut(ws(c_char(')'))).parse(remaining)?;
    if verts.len() < 3 {
        return Err(nom::Err::Failure(Error::new(remaining, ErrorKind::Verify)));
    }
    Ok((remaining, ShapeOp::Polygon(verts)))
}

/// Parses `Mat("Brick")` / `Mat(Brick)` (id only) or `Mat("Brick", 1800)` /
/// `Mat(Brick, 1800)` (id + mass density in kg/m³).
fn parse_mat(input: &str) -> IResult<&str, ShapeOp> {
    let (input, _) = keyword("Mat")(input)?;
    let (input, _) = cut(ws(c_char('('))).parse(input)?;
    let (input, mat_id) = cut(ws(rule_name)).parse(input)?;
    let (input, density) = opt(preceded(ws(c_char(',')), ws(finite_float))).parse(input)?;
    let (input, _) = cut(ws(c_char(')'))).parse(input)?;
    if let Some(d) = density
        && d <= 0.0
    {
        return Err(nom::Err::Failure(Error::new(input, ErrorKind::Verify)));
    }
    let material = crate::model::Material {
        id: mat_id,
        density,
    };
    Ok((input, ShapeOp::Mat(material)))
}

/// Parses a named world-direction shorthand: `Up`, `Down`, `Right`, `Left`,
/// `Forward`, `Back` (also accepted with a `World.` prefix).
fn parse_align_target(input: &str) -> IResult<&str, Vec3> {
    let (input, _) = opt(terminated(tag("World"), c_char('.'))).parse(input)?;
    let (input, name) = identifier.parse(input)?;
    let v = match name {
        "Up" => Vec3::new(0.0, 1.0, 0.0),
        "Down" => Vec3::new(0.0, -1.0, 0.0),
        "Right" => Vec3::new(1.0, 0.0, 0.0),
        "Left" => Vec3::new(-1.0, 0.0, 0.0),
        "Forward" => Vec3::new(0.0, 0.0, -1.0),
        "Back" => Vec3::new(0.0, 0.0, 1.0),
        _ => return Err(nom::Err::Failure(Error::new(input, ErrorKind::Tag))),
    };
    Ok((input, v))
}

/// `Align(Y, Up)` or `Align(Z, World.Forward)`
fn parse_align(input: &str) -> IResult<&str, ShapeOp> {
    let (input, _) = keyword("Align")(input)?;
    let (input, _) = cut(ws(c_char('('))).parse(input)?;
    let (input, local_axis) = cut(ws(parse_axis)).parse(input)?;
    let (input, _) = cut(ws(c_char(','))).parse(input)?;
    let (input, target) = cut(ws(parse_align_target)).parse(input)?;
    let (input, _) = cut(ws(c_char(')'))).parse(input)?;
    Ok((input, ShapeOp::Align { local_axis, target }))
}

fn parse_offset_case(input: &str) -> IResult<&str, OffsetCase> {
    let (input, sel_str) = ws(identifier).parse(input)?;
    let selector = OffsetSelector::parse(sel_str)
        .ok_or_else(|| nom::Err::Failure(Error::new(input, ErrorKind::Tag)))?;
    let (input, _) = ws(c_char(':')).parse(input)?;
    let (input, rule) = ws(parse_rule_call).parse(input)?;
    Ok((input, OffsetCase { selector, rule }))
}

/// `Offset(-0.2) { Inside: Glass | Border: Frame }`
fn parse_offset(input: &str) -> IResult<&str, ShapeOp> {
    let (input, _) = keyword("Offset")(input)?;
    let (input, distance) =
        cut(delimited(ws(c_char('(')), arg_expr, ws(c_char(')')))).parse(input)?;
    let (input, _) = cut(ws(c_char('{'))).parse(input)?;
    let (mut remaining, first) = cut(ws(parse_offset_case)).parse(input)?;
    let mut cases = vec![first];
    loop {
        if cases.len() >= MAX_COMP_CASES {
            return Err(nom::Err::Failure(Error::new(
                remaining,
                ErrorKind::TooLarge,
            )));
        }
        let Ok((after_sep, _)) = ws::<_, _, Error<&str>>(c_char('|')).parse(remaining) else {
            break;
        };
        match ws(parse_offset_case).parse(after_sep) {
            Ok((after_item, case)) => {
                cases.push(case);
                remaining = after_item;
            }
            Err(nom::Err::Failure(e)) => return Err(nom::Err::Failure(e)),
            Err(_) => {
                remaining = after_sep;
                break;
            }
        }
    }
    let (remaining, _) = ws(c_char('}')).parse(remaining)?;
    Ok((remaining, ShapeOp::Offset { distance, cases }))
}

fn parse_roof_case(input: &str) -> IResult<&str, RoofCase> {
    let (input, sel_str) = ws(identifier).parse(input)?;
    let selector = RoofFaceSelector::parse(sel_str)
        .ok_or_else(|| nom::Err::Failure(Error::new(input, ErrorKind::Tag)))?;
    let (input, _) = ws(c_char(':')).parse(input)?;
    let (input, rule) = ws(parse_rule_call).parse(input)?;
    Ok((input, RoofCase { selector, rule }))
}

/// Accumulator for `Roof`'s named parameters.
#[derive(Default)]
struct RoofNamed {
    overhang: Option<Expr>,
    offset: Option<Expr>,
    tier: Option<Expr>,
    fascia: Option<Expr>,
    secondary: Option<Expr>,
    height: Option<Expr>,
    ridge: Option<Axis>,
}

/// Parses `key=<expr>` named parameters for Roof in any order after the
/// positional args: `overhang=`, `offset=`, `tier=`, `fascia=`, `secondary=`,
/// `height=`, plus the axis-valued `ridge=X|Z`. Each is preceded by a comma.
fn parse_roof_named_params(input: &str) -> IResult<&str, RoofNamed> {
    let mut remaining = input;
    let mut named = RoofNamed::default();

    loop {
        // Attempt to consume a comma.
        let Ok((after_comma, _)) = ws::<_, _, Error<&str>>(c_char(',')).parse(remaining) else {
            break;
        };
        // `key =` lookahead; unknown keys end the loop without consuming.
        let Ok((after_eq, (key, _))) = (
            ws::<_, _, Error<&str>>(identifier),
            ws::<_, _, Error<&str>>(c_char('=')),
        )
            .parse(after_comma)
        else {
            break;
        };
        if key == "ridge" {
            let (rest, axis) = cut(ws(parse_axis)).parse(after_eq)?;
            if axis == Axis::Y {
                // A ridge must run horizontally across the footprint.
                return Err(nom::Err::Failure(Error::new(after_eq, ErrorKind::Verify)));
            }
            named.ridge = Some(axis);
            remaining = rest;
            continue;
        }
        let slot = match key {
            "overhang" => &mut named.overhang,
            "offset" => &mut named.offset,
            "tier" => &mut named.tier,
            "fascia" => &mut named.fascia,
            "secondary" => &mut named.secondary,
            "height" => &mut named.height,
            _ => break,
        };
        let (rest, e) = cut(arg_expr).parse(after_eq)?;
        *slot = Some(e);
        remaining = rest;
    }
    Ok((remaining, named))
}

/// Whether a `RoofType` uses the third positional argument as `secondary_pitch`
/// rather than `overhang`.
fn roof_type_uses_secondary_pitch(rt: RoofType) -> bool {
    matches!(rt, RoofType::Gambrel | RoofType::Mansard)
}

/// `Roof(Gable, 30) { Slope: Tiles | GableEnd: Bricks }`
/// `Roof(Hip, 30, 0.5) { Slope: Tiles }`
/// `Roof(Gambrel, 45, 20) { LowerSlope: Shingles | UpperSlope: Tiles }`
/// `Roof(Saltbox, 45, offset=0.3) { Slope: Tiles | GableEnd: Bricks }`
/// `Roof(DutchGable, 45, tier=0.7) { Slope: Tiles | GableEnd: Bricks }`
/// `Roof(Mansard, 60, 20, tier=0.4) { LowerSlope: Plaster | UpperSlope: Tiles }`
fn parse_roof(input: &str) -> IResult<&str, ShapeOp> {
    let (input, _) = keyword("Roof")(input)?;
    let (input, _) = cut(ws(c_char('('))).parse(input)?;
    let (input, type_str) = cut(ws(identifier)).parse(input)?;
    let roof_type = RoofType::parse(type_str)
        .ok_or_else(|| nom::Err::Failure(Error::new(input, ErrorKind::Tag)))?;

    // Positional pitch — omitted when the caller goes straight to named args
    // (`Roof(Gable, height=4)`). Lookahead: `ident =` means named-params begin.
    let named_ahead = |s: &str| {
        (
            ws::<_, _, Error<&str>>(identifier),
            ws::<_, _, Error<&str>>(c_char('=')),
        )
            .parse(s)
            .is_ok()
    };

    let mut pitch: Option<Expr> = None;
    let mut second_positional: Option<Expr> = None;
    let mut remaining = input;

    if let Ok((after_comma, _)) = ws::<_, _, Error<&str>>(c_char(',')).parse(remaining)
        && !named_ahead(after_comma)
    {
        let (rest, p) = cut(arg_expr).parse(after_comma)?;
        if let Some(v) = p.as_lit()
            && (v <= 0.0 || v >= 90.0)
        {
            return Err(nom::Err::Failure(Error::new(rest, ErrorKind::Verify)));
        }
        pitch = Some(p);
        remaining = rest;
        // Optional second positional: secondary pitch for Gambrel/Mansard,
        // overhang for every other type.
        if let Ok((after_c2, _)) = ws::<_, _, Error<&str>>(c_char(',')).parse(remaining)
            && !named_ahead(after_c2)
        {
            let (rest2, v) = cut(arg_expr).parse(after_c2)?;
            second_positional = Some(v);
            remaining = rest2;
        }
    }

    let uses_secondary = roof_type_uses_secondary_pitch(roof_type);
    let mut secondary_pitch: Option<Expr> = None;
    let mut overhang: Option<Expr> = None;
    if let Some(v) = second_positional {
        if uses_secondary {
            secondary_pitch = Some(v);
        } else {
            if let Some(lit) = v.as_lit()
                && lit < 0.0
            {
                return Err(nom::Err::Failure(Error::new(remaining, ErrorKind::Verify)));
            }
            overhang = Some(v);
        }
    }

    // Parse named params (any order); named overrides positional.
    let (input, named) = parse_roof_named_params(remaining)?;
    if let Some(v) = named.overhang {
        if let Some(lit) = v.as_lit()
            && lit < 0.0
        {
            return Err(nom::Err::Failure(Error::new(input, ErrorKind::Verify)));
        }
        overhang = Some(v);
    }
    if let Some(v) = named.secondary {
        secondary_pitch = Some(v);
    }

    let (input, _) = cut(ws(c_char(')'))).parse(input)?;

    // Steepness must come from somewhere: a positional pitch or `height=`.
    let Some(pitch) = pitch.or_else(|| named.height.is_some().then(|| Expr::lit(45.0))) else {
        return Err(nom::Err::Failure(Error::new(input, ErrorKind::Verify)));
    };

    let spec = RoofSpec {
        roof_type,
        pitch,
        height: named.height,
        secondary_pitch,
        overhang: overhang.unwrap_or_else(|| Expr::lit(0.0)),
        ridge_offset: named.offset.unwrap_or_else(|| Expr::lit(0.5)),
        fascia_depth: named.fascia.unwrap_or_else(|| Expr::lit(0.0)),
        tier_height: named.tier,
        ridge_axis: named.ridge,
    };

    let (input, _) = cut(ws(c_char('{'))).parse(input)?;
    let (mut remaining, first) = cut(ws(parse_roof_case)).parse(input)?;
    let mut cases = vec![first];
    loop {
        if cases.len() >= MAX_COMP_CASES {
            return Err(nom::Err::Failure(Error::new(
                remaining,
                ErrorKind::TooLarge,
            )));
        }
        let Ok((after_sep, _)) = ws::<_, _, Error<&str>>(c_char('|')).parse(remaining) else {
            break;
        };
        match ws(parse_roof_case).parse(after_sep) {
            Ok((after_item, case)) => {
                cases.push(case);
                remaining = after_item;
            }
            Err(nom::Err::Failure(e)) => return Err(nom::Err::Failure(e)),
            Err(_) => {
                remaining = after_sep;
                break;
            }
        }
    }
    let (remaining, _) = ws(c_char('}')).parse(remaining)?;
    Ok((remaining, ShapeOp::Roof { spec, cases }))
}

/// Parses a single `Attach` case: `Surface: Rule` or `All: Rule`.
fn parse_attach_case(input: &str) -> IResult<&str, AttachCase> {
    let (input, sel_str) = ws(identifier).parse(input)?;
    let selector = AttachSelector::parse(sel_str)
        .ok_or_else(|| nom::Err::Failure(Error::new(input, ErrorKind::Tag)))?;
    let (input, _) = ws(c_char(':')).parse(input)?;
    let (input, rule) = ws(parse_rule_call).parse(input)?;
    Ok((input, AttachCase { selector, rule }))
}

/// Named world-direction targets shared with `Align`.
fn parse_world_axis(input: &str) -> IResult<&str, Vec3> {
    let (input, name) = ws(identifier).parse(input)?;
    let v = match name {
        "Up" | "up" => Vec3::Y,
        "Down" | "down" => Vec3::NEG_Y,
        "Right" | "right" => Vec3::X,
        "Left" | "left" => Vec3::NEG_X,
        "Forward" | "forward" => Vec3::NEG_Z,
        "Back" | "back" => Vec3::Z,
        _ => return Err(nom::Err::Failure(Error::new(input, ErrorKind::Tag))),
    };
    Ok((input, v))
}

/// `Attach(Up) { Surface: DormerMass }`
fn parse_attach(input: &str) -> IResult<&str, ShapeOp> {
    let (input, _) = keyword("Attach")(input)?;
    let (input, _) = cut(ws(c_char('('))).parse(input)?;
    let (input, world_axis) = cut(ws(parse_world_axis)).parse(input)?;
    let (input, _) = cut(ws(c_char(')'))).parse(input)?;
    let (input, _) = cut(ws(c_char('{'))).parse(input)?;
    let (mut remaining, first) = cut(ws(parse_attach_case)).parse(input)?;
    let mut cases = vec![first];
    loop {
        if cases.len() >= MAX_COMP_CASES {
            return Err(nom::Err::Failure(Error::new(
                remaining,
                ErrorKind::TooLarge,
            )));
        }
        let Ok((after_sep, _)) = ws::<_, _, Error<&str>>(c_char('|')).parse(remaining) else {
            break;
        };
        match ws(parse_attach_case).parse(after_sep) {
            Ok((after_item, case)) => {
                cases.push(case);
                remaining = after_item;
            }
            Err(nom::Err::Failure(e)) => return Err(nom::Err::Failure(e)),
            Err(_) => {
                remaining = after_sep;
                break;
            }
        }
    }
    let (remaining, _) = ws(c_char('}')).parse(remaining)?;
    Ok((remaining, ShapeOp::Attach { world_axis, cases }))
}

/// `Size(x, y, z)` — absolute scope size (CGA `s()` parity).
fn parse_size(input: &str) -> IResult<&str, ShapeOp> {
    let (input, _) = keyword("Size")(input)?;
    let (input, v) = cut(ws(parse_expr3)).parse(input)?;
    for c in &v {
        if let Some(lit) = c.as_lit()
            && lit < 0.0
        {
            return Err(nom::Err::Failure(Error::new(input, ErrorKind::Verify)));
        }
    }
    Ok((input, ShapeOp::Size(v)))
}

/// `Center(X)` / `Center(XZ)` / `Center(XYZ)` — recentre masked axes within
/// the rule-entry bounds.
fn parse_center(input: &str) -> IResult<&str, ShapeOp> {
    let (input, _) = keyword("Center")(input)?;
    let (input, _) = cut(ws(c_char('('))).parse(input)?;
    let (input, mask) = cut(ws(identifier)).parse(input)?;
    let (mut x, mut y, mut z) = (false, false, false);
    for ch in mask.chars() {
        match ch {
            'X' | 'x' => x = true,
            'Y' | 'y' => y = true,
            'Z' | 'z' => z = true,
            _ => return Err(nom::Err::Failure(Error::new(input, ErrorKind::Verify))),
        }
    }
    if !(x || y || z) {
        return Err(nom::Err::Failure(Error::new(input, ErrorKind::Verify)));
    }
    let (input, _) = cut(ws(c_char(')'))).parse(input)?;
    Ok((input, ShapeOp::Center { x, y, z }))
}

/// `Mirror(X)` — mirrors the pending face profile across its vertical
/// centre line. Only the X form exists (profiles are 2-D).
fn parse_mirror(input: &str) -> IResult<&str, ShapeOp> {
    let (input, _) = keyword("Mirror")(input)?;
    let (input, _) = cut(ws(c_char('('))).parse(input)?;
    let (input, axis) = cut(ws(parse_axis)).parse(input)?;
    if axis != Axis::X {
        return Err(nom::Err::Failure(Error::new(input, ErrorKind::Verify)));
    }
    let (input, _) = cut(ws(c_char(')'))).parse(input)?;
    Ok((input, ShapeOp::Mirror))
}

fn parse_carve_case(input: &str) -> IResult<&str, CarveCase> {
    let (input, sel_str) = ws(identifier).parse(input)?;
    let selector = CarveSelector::parse(sel_str)
        .ok_or_else(|| nom::Err::Failure(Error::new(input, ErrorKind::Tag)))?;
    let (input, _) = ws(c_char(':')).parse(input)?;
    let (input, rule) = ws(parse_rule_call).parse(input)?;
    Ok((input, CarveCase { selector, rule }))
}

fn parse_carve_cases(input: &str) -> IResult<&str, Vec<CarveCase>> {
    let (input, _) = cut(ws(c_char('{'))).parse(input)?;
    let (mut remaining, first) = cut(ws(parse_carve_case)).parse(input)?;
    let mut cases = vec![first];
    loop {
        if cases.len() >= MAX_COMP_CASES {
            return Err(nom::Err::Failure(Error::new(
                remaining,
                ErrorKind::TooLarge,
            )));
        }
        let Ok((after_sep, _)) = ws::<_, _, Error<&str>>(c_char('|')).parse(remaining) else {
            break;
        };
        let (after_item, case) = cut(ws(parse_carve_case)).parse(after_sep)?;
        cases.push(case);
        remaining = after_item;
    }
    let (remaining, _) = cut(ws(c_char('}'))).parse(remaining)?;
    Ok((remaining, cases))
}

/// `ShapeL(front, side) { Shape: Wing | Remainder: Court }`
fn parse_shape_l(input: &str) -> IResult<&str, ShapeOp> {
    let (input, _) = keyword("ShapeL")(input)?;
    let (input, _) = cut(ws(c_char('('))).parse(input)?;
    let (input, front) = cut(arg_expr).parse(input)?;
    let (input, _) = cut(ws(c_char(','))).parse(input)?;
    let (input, side) = cut(arg_expr).parse(input)?;
    let (input, _) = cut(ws(c_char(')'))).parse(input)?;
    let (input, cases) = parse_carve_cases(input)?;
    Ok((input, ShapeOp::ShapeL { front, side, cases }))
}

/// `ShapeU(front, left, right) { Shape: Range | Remainder: Court }`
fn parse_shape_u(input: &str) -> IResult<&str, ShapeOp> {
    let (input, _) = keyword("ShapeU")(input)?;
    let (input, _) = cut(ws(c_char('('))).parse(input)?;
    let (input, front) = cut(arg_expr).parse(input)?;
    let (input, _) = cut(ws(c_char(','))).parse(input)?;
    let (input, left) = cut(arg_expr).parse(input)?;
    let (input, _) = cut(ws(c_char(','))).parse(input)?;
    let (input, right) = cut(arg_expr).parse(input)?;
    let (input, _) = cut(ws(c_char(')'))).parse(input)?;
    let (input, cases) = parse_carve_cases(input)?;
    Ok((
        input,
        ShapeOp::ShapeU {
            front,
            left,
            right,
            cases,
        },
    ))
}

fn parse_rule_ref(input: &str) -> IResult<&str, ShapeOp> {
    map(ws(parse_rule_call), ShapeOp::Rule).parse(input)
}

// ── Top-level op parser ───────────────────────────────────────────────────────

fn parse_op(input: &str) -> IResult<&str, ShapeOp> {
    // Order matters: longer/specific tags must come before the generic
    // rule_name fallback. Nested `alt`s sidestep nom's tuple-arity cap.
    alt((
        alt((
            parse_extrude,
            parse_taper,
            parse_rotate,
            parse_translate,
            parse_scale,
            // `SplitArea` before `Split`: `Split` is a prefix of `SplitArea`
            // and consumes the keyword with a fatal cut on its arguments.
            parse_split_area,
            parse_split,
            parse_fit,
            parse_shape_l,
            parse_shape_u,
            parse_size,
            parse_center,
            parse_mirror,
            parse_repeat,
            parse_comp,
        )),
        alt((
            // The `If*` family MUST come before `parse_instance` —
            // `parse_instance` matches `I(` with `cut` (fatal-on-failure),
            // which greedily consumes the `I` prefix of `IfClear` etc. and
            // then errors instead of falling through.
            parse_if_clear,
            parse_if_occluded,
            parse_if_inside,
            parse_if_touches,
            parse_label,
            parse_scatter,
            parse_pick,
            parse_instance,
            parse_mat,
            parse_align,
            parse_offset,
            parse_roof,
            parse_attach,
            parse_polygon,
            parse_reg_snap,
            parse_rule_ref,
        )),
    ))
    .parse(input)
}

// ── Public API ────────────────────────────────────────────────────────────────

/// Returns true if `op` ends execution of a rule body — either by branching
/// (Split / Comp / Repeat / Offset / Roof) or by producing a terminal (I / Rule).
/// Any operations listed after such an op in the source are unreachable.
fn is_terminating_op(op: &ShapeOp) -> bool {
    matches!(
        op,
        ShapeOp::I(_)
            | ShapeOp::Rule(_)
            | ShapeOp::Split { .. }
            | ShapeOp::SplitArea { .. }
            | ShapeOp::Fit { .. }
            | ShapeOp::ShapeL { .. }
            | ShapeOp::ShapeU { .. }
            | ShapeOp::Comp(_)
            | ShapeOp::Repeat { .. }
            | ShapeOp::Offset { .. }
            | ShapeOp::Roof { .. }
            | ShapeOp::Attach { .. }
            | ShapeOp::Scatter { .. }
            | ShapeOp::Pick { .. }
    )
}

/// Parses a sequence of CGA operations separated by optional whitespace/newlines.
///
/// # Example
/// ```
/// use symbios_shape::grammar::parse_ops;
///
/// let ops = parse_ops("Extrude(10) Split(Y) { ~1: Floor | 2: Roof }").unwrap();
/// assert_eq!(ops.len(), 2);
/// ```
pub fn parse_ops(input: &str) -> Result<Vec<ShapeOp>, ShapeError> {
    let mut remaining = input;
    let mut ops = Vec::new();

    loop {
        let (next, _) = space_or_comment::<Error<&str>>(remaining)
            .map_err(|e| ShapeError::ParseError(e.to_string()))?;
        remaining = next;

        if remaining.is_empty() {
            break;
        }

        if ops.len() >= MAX_OPS {
            return Err(ShapeError::CapacityOverflow);
        }

        let (next, op) = parse_op(remaining).map_err(|e| ShapeError::ParseError(e.to_string()))?;
        let terminates = is_terminating_op(&op);
        ops.push(op);
        remaining = next;

        if terminates {
            // Any content after a terminal/branching op is unreachable. Catch it
            // here so the parser rejects such rules rather than silently dropping ops.
            let (after_ws, _) = space_or_comment::<Error<&str>>(remaining)
                .map_err(|e| ShapeError::ParseError(e.to_string()))?;
            if !after_ws.is_empty() {
                return Err(ShapeError::ParseError(
                    "unreachable operations after terminal or branching op".to_string(),
                ));
            }
            break;
        }
    }

    Ok(ops)
}

// ── Stochastic rule helpers ───────────────────────────────────────────────────

/// Splits `s` on `|` characters at brace depth 0, respecting quoted strings
/// and comments so that `|` inside `"Wall|Door"` or `/* { */` is ignored.
///
/// Returns at most [`MAX_VARIANTS`] parts; exceeding that limit returns
/// `Err(CapacityOverflow)` before any further allocation occurs.
///
/// Contexts handled:
/// - `"..."` string literals — `|` and `{`/`}` inside are invisible.
/// - `/* ... */` block comments — same.
/// - `// ...` line comments — same (skipped until `\n` or `\r`).
fn split_top_level_pipe(s: &str) -> Result<Vec<&str>, ShapeError> {
    let mut depth: i32 = 0;
    let mut in_string = false;
    let mut in_block_comment = false;
    let mut in_line_comment = false;
    let mut start = 0;
    let mut parts = Vec::new();
    // Use a Peekable iterator so we never allocate the full char list — a
    // Vec<(usize,char)> of the whole input would be O(n) memory (16 bytes per
    // char on 64-bit) even before any safety limits can fire.
    let mut iter = s.char_indices().peekable();

    while let Some((byte_pos, c)) = iter.next() {
        if in_line_comment {
            if c == '\n' || c == '\r' {
                in_line_comment = false;
            }
            continue;
        }

        if in_block_comment {
            if c == '*' && matches!(iter.peek(), Some((_, '/'))) {
                iter.next(); // consume '/'
                in_block_comment = false;
            }
            continue;
        }

        if in_string {
            if c == '"' {
                in_string = false;
            }
            continue;
        }

        // Normal (unquoted, uncommented) context — check for comment openers.
        if c == '/' {
            match iter.peek() {
                Some(&(_, '/')) => {
                    iter.next();
                    in_line_comment = true;
                    continue;
                }
                Some(&(_, '*')) => {
                    iter.next();
                    in_block_comment = true;
                    continue;
                }
                _ => {}
            }
        }

        match c {
            '"' => in_string = true,
            '{' => depth += 1,
            '}' => depth -= 1,
            '|' if depth == 0 => {
                // After this push, `parts.len() + 1` parts exist; the loop's
                // final push adds one more, giving `parts.len() + 2` total.
                // Reject before the push when that would exceed MAX_VARIANTS.
                if parts.len() + 2 > MAX_VARIANTS {
                    return Err(ShapeError::CapacityOverflow);
                }
                parts.push(s[start..byte_pos].trim());
                start = byte_pos + c.len_utf8();
            }
            _ => {}
        }
    }

    parts.push(s[start..].trim());
    Ok(parts)
}

fn parse_weight_prefix(input: &str) -> IResult<&str, f64> {
    let (input, w) = ws(double).parse(input)?;
    let (input, _) = ws(c_char('%')).parse(input)?;
    Ok((input, w))
}

/// Tries to parse `float%` from the start of `input`, returning `(weight_0_to_1, rest)`.
fn try_parse_weight(input: &str) -> Option<(f64, &str)> {
    let trimmed = input.trim_start();
    match parse_weight_prefix(trimmed) {
        Ok((rest, w)) if w.is_finite() && w >= 0.0 => Some((w / 100.0, rest)),
        _ => None,
    }
}

// ── Named grammar rules ───────────────────────────────────────────────────────

/// A named production rule in a shape grammar.
///
/// A rule may declare parameters, and its variants are either weighted
/// (stochastic) or guarded (`when(cond): … | else: …`):
///
/// ```text
/// Lot --> Extrude(10) Split(Y) { ~1: Floor | 2: Roof }
/// Facade --> 70% BrickWall | 30% GlassCurtain
/// Bay --> when(scope.x < 1.2): Wall | else: Window
/// Spire(n) --> when(n == 0): I("finial") | else: Extrude(scope.y * 0.7) Spire(n - 1)
/// ```
#[derive(Debug, Clone)]
pub struct GrammarRule {
    pub name: String,
    /// Declared parameter names (`Spire(n)`); empty for plain rules.
    pub params: Vec<String>,
    pub variants: Vec<RuleVariant>,
}

impl GrammarRule {
    /// Convenience accessor for deterministic (single-variant) rules.
    /// Returns an empty slice if the rule has no variants.
    pub fn ops(&self) -> &[ShapeOp] {
        self.variants
            .first()
            .map(|v| v.ops.as_slice())
            .unwrap_or(&[])
    }
}

/// Tries to parse a `when ( expr ) :` guard prefix.
fn try_parse_when(part: &str) -> Option<Result<(Expr, &str), ShapeError>> {
    let trimmed = part.trim_start();
    let rest = trimmed.strip_prefix("when")?;
    // Must be a keyword use, not an identifier prefix (`whenever`).
    if rest.chars().next().is_some_and(is_ident_char) {
        return None;
    }
    let parse = || -> Result<(Expr, &str), ShapeError> {
        let (rest2, _) = ws::<_, _, Error<&str>>(c_char('('))
            .parse(rest)
            .map_err(|e| ShapeError::ParseError(e.to_string()))?;
        let (rest3, cond) = arg_expr(rest2).map_err(|e| ShapeError::ParseError(e.to_string()))?;
        let (rest4, _) = ws::<_, _, Error<&str>>(c_char(')'))
            .parse(rest3)
            .map_err(|e| ShapeError::ParseError(e.to_string()))?;
        let (rest5, _) = ws::<_, _, Error<&str>>(c_char(':'))
            .parse(rest4)
            .map_err(|e| ShapeError::ParseError(e.to_string()))?;
        Ok((cond, rest5))
    };
    Some(parse())
}

/// Tries to parse an `else :` prefix.
fn try_parse_else(part: &str) -> Option<&str> {
    let trimmed = part.trim_start();
    let rest = trimmed.strip_prefix("else")?;
    if rest.chars().next().is_some_and(is_ident_char) {
        return None;
    }
    let (rest2, _) = ws::<_, _, Error<&str>>(c_char(':')).parse(rest).ok()?;
    Some(rest2)
}

/// Parses the optional `(p1, p2, …)` parameter declaration on a rule head.
fn parse_param_decl(input: &str) -> Result<(Vec<String>, &str), ShapeError> {
    let Ok((rest, _)) = ws::<_, _, Error<&str>>(c_char('(')).parse(input) else {
        return Ok((Vec::new(), input));
    };
    let mut params = Vec::new();
    let mut remaining = rest;
    if let Ok((after, _)) = ws::<_, _, Error<&str>>(c_char(')')).parse(remaining) {
        return Ok((params, after));
    }
    loop {
        let (after, p) = ws(identifier)
            .parse(remaining)
            .map_err(|e| ShapeError::ParseError(e.to_string()))?;
        if params.contains(&p.to_string()) {
            return Err(ShapeError::ParseError(format!(
                "duplicate rule parameter name: {p}"
            )));
        }
        params.push(p.to_string());
        if params.len() > MAX_RULE_ARGS {
            return Err(ShapeError::CapacityOverflow);
        }
        if let Ok((after2, _)) = ws::<_, _, Error<&str>>(c_char(',')).parse(after) {
            remaining = after2;
            continue;
        }
        let (after2, _) = ws::<_, _, Error<&str>>(c_char(')'))
            .parse(after)
            .map_err(|e| ShapeError::ParseError(e.to_string()))?;
        return Ok((params, after2));
    }
}

/// One top-level grammar statement.
#[derive(Debug, Clone)]
pub enum Statement {
    Rule(GrammarRule),
    /// `attr Name = expr` — host-overridable knob (constant expression).
    Attr {
        name: String,
        value: f64,
    },
    /// `const Name = expr` — fixed named value (constant expression).
    Const {
        name: String,
        value: f64,
    },
    /// `style Name [extends Base] { A = 1, B = 2 }` — named attr override set.
    Style {
        name: String,
        extends: Option<String>,
        overrides: Vec<(String, f64)>,
    },
}

/// Evaluates a declaration expression, which must be constant: no scope /
/// split / depth variables, no named references, no `rand`.
fn const_eval(e: &Expr, at: &str) -> Result<f64, ShapeError> {
    fn check(e: &Expr) -> bool {
        match e {
            Expr::Lit(_) => true,
            Expr::Var(_) => false,
            Expr::Unary(_, a) => check(a),
            Expr::Binary(_, a, b) => check(a) && check(b),
            Expr::Call(f, args) => *f != crate::expr::Func::Rand && args.iter().all(check),
        }
    }
    if !check(e) {
        return Err(ShapeError::ParseError(format!(
            "declaration value must be a constant expression (no variables, no rand): {at:?}"
        )));
    }
    let mut rng = rand_pcg::Pcg64::new(0, 0);
    let globals = std::collections::HashMap::new();
    let mut ctx = crate::expr::EvalCtx {
        scope_size: crate::scope::Vec3::ZERO,
        split_i: 0.0,
        split_n: 1.0,
        depth: 0.0,
        params: &[],
        globals: &globals,
        rng: &mut rng,
    };
    e.eval(&mut ctx)
}

/// Parses `Name = expr` (comma list) inside a style block.
fn parse_style_overrides(input: &str) -> Result<Vec<(String, f64)>, ShapeError> {
    let mut out = Vec::new();
    let mut remaining = input;
    loop {
        let (rest, name) = ws::<_, _, Error<&str>>(identifier)
            .parse(remaining)
            .map_err(|e| ShapeError::ParseError(e.to_string()))?;
        let (rest, _) = ws::<_, _, Error<&str>>(c_char('='))
            .parse(rest)
            .map_err(|e| ShapeError::ParseError(e.to_string()))?;
        let (rest, value_expr) =
            arg_expr(rest).map_err(|e| ShapeError::ParseError(e.to_string()))?;
        out.push((name.to_string(), const_eval(&value_expr, name)?));
        if out.len() > MAX_SPLIT_SLOTS {
            return Err(ShapeError::CapacityOverflow);
        }
        if let Ok((rest2, _)) = ws::<_, _, Error<&str>>(c_char(',')).parse(rest) {
            remaining = rest2;
            continue;
        }
        let (rest2, _) = ws::<_, _, Error<&str>>(c_char('}'))
            .parse(rest)
            .map_err(|e| ShapeError::ParseError(e.to_string()))?;
        let (rest3, _) = space_or_comment::<Error<&str>>(rest2)
            .map_err(|e| ShapeError::ParseError(e.to_string()))?;
        if !rest3.is_empty() {
            return Err(ShapeError::ParseError(format!(
                "trailing input after style block: {rest3:?}"
            )));
        }
        return Ok(out);
    }
}

/// Parses one top-level statement: a rule, or an `attr` / `const` / `style`
/// declaration.
///
/// ```text
/// attr Floors = 4
/// const FloorH = 3.2
/// style Poor { Floors = 2, Wear = 0.8 }
/// style Rich extends Poor { Floors = 6 }
/// Lot --> Extrude(Floors * FloorH) I("Mass")
/// ```
pub fn parse_statement(input: &str) -> Result<Statement, ShapeError> {
    let (rest, _) = space_or_comment::<Error<&str>>(input)
        .map_err(|e| ShapeError::ParseError(e.to_string()))?;
    // Keyword lookahead: `attr` / `const` / `style` followed by non-ident.
    for (kw, is_attr) in [("attr", true), ("const", false)] {
        if let Some(after) = rest.strip_prefix(kw)
            && !after.chars().next().is_some_and(is_ident_char)
        {
            let (after2, name) = ws::<_, _, Error<&str>>(identifier)
                .parse(after)
                .map_err(|e| ShapeError::ParseError(e.to_string()))?;
            let (after3, _) = ws::<_, _, Error<&str>>(c_char('='))
                .parse(after2)
                .map_err(|e| ShapeError::ParseError(e.to_string()))?;
            let (after4, value_expr) =
                arg_expr(after3).map_err(|e| ShapeError::ParseError(e.to_string()))?;
            let (after5, _) = space_or_comment::<Error<&str>>(after4)
                .map_err(|e| ShapeError::ParseError(e.to_string()))?;
            if !after5.is_empty() {
                return Err(ShapeError::ParseError(format!(
                    "trailing input after declaration: {after5:?}"
                )));
            }
            let value = const_eval(&value_expr, name)?;
            return Ok(if is_attr {
                Statement::Attr {
                    name: name.to_string(),
                    value,
                }
            } else {
                Statement::Const {
                    name: name.to_string(),
                    value,
                }
            });
        }
    }
    if let Some(after) = rest.strip_prefix("style")
        && !after.chars().next().is_some_and(is_ident_char)
    {
        let (after2, name) = ws::<_, _, Error<&str>>(identifier)
            .parse(after)
            .map_err(|e| ShapeError::ParseError(e.to_string()))?;
        let (after3, extends) =
            if let Ok((a, _)) = ws::<_, _, Error<&str>>(tag("extends")).parse(after2) {
                let (a2, base) = ws::<_, _, Error<&str>>(identifier)
                    .parse(a)
                    .map_err(|e| ShapeError::ParseError(e.to_string()))?;
                (a2, Some(base.to_string()))
            } else {
                (after2, None)
            };
        let (after4, _) = ws::<_, _, Error<&str>>(c_char('{'))
            .parse(after3)
            .map_err(|e| ShapeError::ParseError(e.to_string()))?;
        let overrides = parse_style_overrides(after4)?;
        return Ok(Statement::Style {
            name: name.to_string(),
            extends,
            overrides,
        });
    }
    Ok(Statement::Rule(parse_rule(input)?))
}

/// Parses a complete named grammar rule.
///
/// Forms:
/// - deterministic: `Name --> op op ...`
/// - stochastic: `Name --> 70% ops | 30% ops` (optionally `| else: ops` for
///   the remaining probability mass, treating weights as percentages)
/// - guarded: `Name --> when(cond): ops | when(cond): ops | else: ops`
/// - parameterized head: `Name(a, b) --> ...`
///
/// Weighted and guarded variants cannot be mixed in one rule.
pub fn parse_rule(input: &str) -> Result<GrammarRule, ShapeError> {
    let (remaining, _) = space_or_comment::<Error<&str>>(input)
        .map_err(|e| ShapeError::ParseError(e.to_string()))?;
    let (remaining, name) = ws(identifier)
        .parse(remaining)
        .map_err(|e| ShapeError::ParseError(e.to_string()))?;
    let (params, remaining) = parse_param_decl(remaining)?;
    let (remaining, _) = ws(tag::<_, _, Error<&str>>("-->"))
        .parse(remaining)
        .map_err(|e| ShapeError::ParseError(e.to_string()))?;

    // Split the body on top-level `|` to detect alternatives.
    let parts = split_top_level_pipe(remaining)?;

    let mut variants: Vec<RuleVariant> = Vec::with_capacity(parts.len());
    let multi = parts.len() > 1;
    for (i, part) in parts.iter().enumerate() {
        let is_last = i + 1 == parts.len();
        if let Some(res) = try_parse_when(part) {
            let (cond, rest) = res?;
            variants.push(RuleVariant {
                selector: VariantSelector::When(cond),
                ops: parse_ops(rest)?,
            });
            continue;
        }
        if let Some(rest) = try_parse_else(part) {
            if !is_last {
                return Err(ShapeError::ParseError(
                    "`else:` must be the last variant".to_string(),
                ));
            }
            variants.push(RuleVariant {
                selector: VariantSelector::Else,
                ops: parse_ops(rest)?,
            });
            continue;
        }
        match try_parse_weight(part) {
            Some((weight, rest)) => variants.push(RuleVariant {
                selector: VariantSelector::Weight(weight),
                ops: parse_ops(rest)?,
            }),
            None if multi => {
                return Err(ShapeError::ParseError(format!(
                    "rule alternative needs a 'weight%', 'when(..):', or 'else:' prefix: {part:?}"
                )));
            }
            None => variants.push(RuleVariant {
                selector: VariantSelector::Weight(1.0),
                ops: parse_ops(part)?,
            }),
        }
    }

    // Resolve selector shape: weighted rules may end with `else:` sugar (the
    // remaining probability mass, weights read as percentages); guarded rules
    // must not contain weights.
    let n_weight = variants
        .iter()
        .filter(|v| matches!(v.selector, VariantSelector::Weight(_)))
        .count();
    let n_when = variants
        .iter()
        .filter(|v| matches!(v.selector, VariantSelector::When(_)))
        .count();
    let has_else = variants
        .iter()
        .any(|v| matches!(v.selector, VariantSelector::Else));

    if n_weight > 0 && n_when > 0 {
        return Err(ShapeError::ParseError(
            "rule mixes weighted and guarded variants".to_string(),
        ));
    }
    if n_weight > 0 && has_else {
        let used: f64 = variants
            .iter()
            .filter_map(|v| match v.selector {
                VariantSelector::Weight(w) => Some(w),
                _ => None,
            })
            .sum();
        let remainder = 1.0 - used;
        if remainder <= 1e-9 {
            return Err(ShapeError::ParseError(format!(
                "`else:` has no probability mass left (weights already sum to {:.0}%)",
                used * 100.0
            )));
        }
        if let Some(last) = variants.last_mut() {
            last.selector = VariantSelector::Weight(remainder);
        }
    }

    Ok(GrammarRule {
        name: name.to_string(),
        params,
        variants,
    })
}

#[cfg(test)]
mod tests {
    use super::*;
    use crate::ops::{Axis, ShapeOp, SplitSize};

    #[test]
    fn test_parse_extrude() {
        let ops = parse_ops("Extrude(10)").unwrap();
        assert_eq!(ops.len(), 1);
        assert_eq!(ops[0], ShapeOp::Extrude(Expr::lit(10.0)));
    }

    #[test]
    fn test_parse_taper() {
        let ops = parse_ops("Taper(0.5)").unwrap();
        assert_eq!(ops[0], ShapeOp::Taper(Expr::lit(0.5)));
    }

    #[test]
    fn test_parse_split_y() {
        let ops = parse_ops("Split(Y) { ~1.0: Floor | ~1.0: Floor | 2.0: Roof }").unwrap();
        assert_eq!(ops.len(), 1);
        let ShapeOp::Split { axis, entries, .. } = &ops[0] else {
            panic!("expected Split");
        };
        let slots: Vec<_> = entries.iter().filter_map(|e| e.as_slot()).collect();
        assert_eq!(*axis, Axis::Y);
        assert_eq!(slots.len(), 3);
        assert_eq!(slots[0].size, SplitSize::float(1.0));
        assert_eq!(slots[0].rule, "Floor");
        assert_eq!(slots[2].size, SplitSize::abs(2.0));
        assert_eq!(slots[2].rule, "Roof");
    }

    #[test]
    fn test_parse_split_relative() {
        let ops = parse_ops("Split(X) { '0.3: Left | '0.7: Right }").unwrap();
        let ShapeOp::Split { entries, .. } = &ops[0] else {
            panic!("expected Split");
        };
        let slots: Vec<_> = entries.iter().filter_map(|e| e.as_slot()).collect();
        assert_eq!(slots[0].size, SplitSize::rel(0.3));
        assert_eq!(slots[1].size, SplitSize::rel(0.7));
    }

    #[test]
    fn test_parse_comp_faces() {
        let ops =
            parse_ops("Comp(Faces) { Top: Roof | Side: Facade | Bottom: Foundation }").unwrap();
        assert_eq!(ops.len(), 1);
        let ShapeOp::Comp(CompTarget::Faces(cases)) = &ops[0] else {
            panic!("expected Comp(Faces)");
        };
        assert_eq!(cases.len(), 3);
        assert_eq!(cases[0].selector, FaceSelector::Top);
        assert_eq!(cases[0].rule, "Roof");
    }

    #[test]
    fn test_parse_instance() {
        let ops = parse_ops(r#"I("Window")"#).unwrap();
        assert_eq!(ops[0], ShapeOp::I("Window".to_string()));
    }

    #[test]
    fn test_parse_mat() {
        let ops = parse_ops(r#"Mat("Brick")"#).unwrap();
        assert_eq!(ops[0], ShapeOp::Mat(crate::model::Material::new("Brick")));
        let ops2 = parse_ops("Mat(Stone)").unwrap();
        assert_eq!(ops2[0], ShapeOp::Mat(crate::model::Material::new("Stone")));
    }

    #[test]
    fn test_parse_mat_with_density() {
        let ops = parse_ops(r#"Mat("Brick", 1800)"#).unwrap();
        assert_eq!(
            ops[0],
            ShapeOp::Mat(crate::model::Material::with_density("Brick", 1800.0))
        );
    }

    #[test]
    fn test_parse_mat_zero_density_rejected() {
        assert!(parse_ops("Mat(Stone, 0)").is_err());
    }

    #[test]
    fn test_parse_mat_negative_density_rejected() {
        assert!(parse_ops("Mat(Stone, -5)").is_err());
    }

    #[test]
    fn test_parse_rule_ref() {
        let ops = parse_ops("Floor").unwrap();
        assert_eq!(ops[0], ShapeOp::Rule("Floor".into()));
    }

    #[test]
    fn test_parse_multiple_ops() {
        let ops =
            parse_ops(r#"Extrude(10) Split(Y) { 2.0: Ground | ~1.0: Upper | 3.0: Roof }"#).unwrap();
        assert_eq!(ops.len(), 2);
    }

    #[test]
    fn test_parse_grammar_rule_deterministic() {
        let rule = parse_rule("Lot --> Extrude(10) Split(Y) { ~1: Floor | 2: Roof }").unwrap();
        assert_eq!(rule.name, "Lot");
        assert_eq!(rule.variants.len(), 1);
        assert!((rule.variants[0].weight().unwrap() - 1.0).abs() < 1e-9);
        assert_eq!(rule.variants[0].ops.len(), 2);
    }

    #[test]
    fn test_parse_grammar_rule_stochastic() {
        let rule = parse_rule("Facade --> 70% BrickWall | 30% GlassCurtain").unwrap();
        assert_eq!(rule.name, "Facade");
        assert_eq!(rule.variants.len(), 2);
        assert!((rule.variants[0].weight().unwrap() - 0.70).abs() < 1e-9);
        assert_eq!(
            rule.variants[0].ops,
            vec![ShapeOp::Rule("BrickWall".into())]
        );
        assert!((rule.variants[1].weight().unwrap() - 0.30).abs() < 1e-9);
        assert_eq!(
            rule.variants[1].ops,
            vec![ShapeOp::Rule("GlassCurtain".into())]
        );
    }

    #[test]
    fn test_parse_stochastic_with_complex_ops() {
        // `|` inside braces must not split the alternative
        let rule = parse_rule("R --> 50% Split(X) { ~1: A | ~1: B } | 50% I(Solid)").unwrap();
        assert_eq!(rule.variants.len(), 2);
        assert_eq!(rule.variants[0].ops.len(), 1); // the Split op
        assert_eq!(rule.variants[1].ops.len(), 1); // I(Solid)
    }

    #[test]
    fn test_extrude_zero_rejected() {
        assert!(parse_ops("Extrude(0)").is_err());
    }

    #[test]
    fn test_taper_out_of_range_rejected() {
        assert!(parse_ops("Taper(1.5)").is_err());
    }

    #[test]
    fn test_comments_ignored() {
        let ops = parse_ops("// comment\nExtrude(5) /* block */ Taper(0.2)").unwrap();
        assert_eq!(ops.len(), 2);
    }

    // ── Issue 5 (review #10): GrammarRule::ops() safe on empty variants ──────

    #[test]
    fn test_grammar_rule_ops_empty_variants_returns_empty() {
        let rule = GrammarRule {
            name: "Empty".to_string(),
            params: vec![],
            variants: vec![],
        };
        assert_eq!(rule.ops(), &[] as &[ShapeOp]);
    }

    // ── Issue 2: quaternion overflow bypass ───────────────────────────────────

    #[test]
    fn test_rotate_overflow_components_rejected() {
        // Each component is finite, but squaring overflows to INFINITY.
        // The len_sq check must catch this and reject the quaternion.
        assert!(parse_ops("Rotate(1e160, 0, 0, 0)").is_err());
        assert!(parse_ops("Rotate(1, 1e200, 0, 0)").is_err());
    }

    // ── Issue 1: split_top_level_pipe must ignore `|` inside quoted strings ────

    #[test]
    fn test_pipe_in_quoted_mesh_id_not_split() {
        // `|` inside `"Wall|Door"` must NOT be treated as a stochastic separator.
        let rule = parse_rule(r#"Lot --> I("Wall|Door")"#).unwrap();
        assert_eq!(rule.variants.len(), 1);
        assert_eq!(
            rule.variants[0].ops,
            vec![ShapeOp::I("Wall|Door".to_string())]
        );
    }

    #[test]
    fn test_block_comment_with_brace_does_not_confuse_depth() {
        // `/* { */` must not increment brace depth, so the top-level `|` is still found.
        let rule = parse_rule("Facade --> 50% Extrude(10) /* { */ | 50% I(Solid)").unwrap();
        assert_eq!(rule.variants.len(), 2);
        assert!((rule.variants[0].weight().unwrap() - 0.50).abs() < 1e-9);
        assert!((rule.variants[1].weight().unwrap() - 0.50).abs() < 1e-9);
    }

    // ── Issue 2: unreachable ops after terminal/branching op are rejected ──────

    #[test]
    fn test_ops_after_instance_rejected() {
        assert!(parse_ops(r#"I("Wall") Scale(2, 2, 2)"#).is_err());
    }

    #[test]
    fn test_ops_after_rule_ref_rejected() {
        assert!(parse_ops("Floor Scale(2, 2, 2)").is_err());
    }

    #[test]
    fn test_ops_after_split_rejected() {
        assert!(parse_ops("Split(Y) { ~1: A | ~1: B } Scale(1, 2, 1)").is_err());
    }

    // ── Issue 3 (review #14): MAX_VARIANTS cap in stochastic rule parsing ───────

    #[test]
    fn test_too_many_variants_rejected() {
        // Build a rule body with MAX_VARIANTS + 1 alternatives.
        let variants: Vec<String> = (0..=MAX_VARIANTS).map(|i| format!("1% I(M{i})")).collect();
        let rule_str = format!("R --> {}", variants.join(" | "));
        assert!(matches!(
            parse_rule(&rule_str),
            Err(ShapeError::CapacityOverflow)
        ));
    }

    #[test]
    fn test_max_variants_boundary_accepted() {
        // Exactly MAX_VARIANTS alternatives must succeed.
        let variants: Vec<String> = (0..MAX_VARIANTS).map(|i| format!("1% I(M{i})")).collect();
        let rule_str = format!("R --> {}", variants.join(" | "));
        let rule = parse_rule(&rule_str).unwrap();
        assert_eq!(rule.variants.len(), MAX_VARIANTS);
    }

    // ── Issue 2 (review #14): cut prevents backtracking on malformed op args ───

    #[test]
    fn test_translate_wrong_arg_count_rejected() {
        // Before cut: "Translate" would backtrack to parse_rule_ref, producing a
        // misleading "unreachable operations after terminal" error.
        // After cut: immediately fatal once "Translate" tag is consumed.
        assert!(parse_ops("Translate(1.0, 2.0)").is_err());
    }

    #[test]
    fn test_extrude_missing_arg_rejected() {
        assert!(parse_ops("Extrude()").is_err());
    }

    #[test]
    fn test_split_missing_brace_rejected() {
        // "Split(Y)" without a body should be a fatal parse error, not a rule ref.
        assert!(parse_ops("Split(Y)").is_err());
    }

    // ── Issue 3: single-variant stochastic rule (100% prefix) ─────────────────

    #[test]
    fn test_single_variant_with_weight_prefix() {
        let rule = parse_rule("Lot --> 100% Extrude(10)").unwrap();
        assert_eq!(rule.variants.len(), 1);
        assert!((rule.variants[0].weight().unwrap() - 1.0).abs() < 1e-9);
        assert_eq!(
            rule.variants[0].ops,
            vec![ShapeOp::Extrude(Expr::lit(10.0))]
        );
    }

    // ── Issue 5: non-positive scale values are rejected ───────────────────────

    #[test]
    fn test_scale_negative_rejected() {
        assert!(parse_ops("Scale(-1, 1, 1)").is_err());
    }

    #[test]
    fn test_scale_zero_rejected() {
        assert!(parse_ops("Scale(0, 1, 1)").is_err());
    }

    #[test]
    fn test_scale_positive_accepted() {
        let ops = parse_ops("Scale(0.5, 2, 1)").unwrap();
        assert_eq!(ops.len(), 1);
    }

    // ── Feature: Align ───────────────────────────────────────────────────────

    #[test]
    fn test_parse_align_basic() {
        let ops = parse_ops("Align(Y, Up)").unwrap();
        assert_eq!(ops.len(), 1);
        let ShapeOp::Align { local_axis, target } = &ops[0] else {
            panic!("expected Align");
        };
        assert_eq!(*local_axis, Axis::Y);
        assert!((*target - crate::scope::Vec3::new(0.0, 1.0, 0.0)).length() < 1e-9);
    }

    #[test]
    fn test_parse_align_world_prefix() {
        let ops = parse_ops("Align(Z, World.Forward)").unwrap();
        let ShapeOp::Align { local_axis, target } = &ops[0] else {
            panic!("expected Align");
        };
        assert_eq!(*local_axis, Axis::Z);
        assert!((*target - crate::scope::Vec3::new(0.0, 0.0, -1.0)).length() < 1e-9);
    }

    #[test]
    fn test_parse_align_unknown_target_rejected() {
        assert!(parse_ops("Align(Y, Sideways)").is_err());
    }

    // ── Feature: Offset ──────────────────────────────────────────────────────

    #[test]
    fn test_parse_offset_basic() {
        let ops = parse_ops("Offset(-0.2) { Inside: Glass | Border: Frame }").unwrap();
        assert_eq!(ops.len(), 1);
        let ShapeOp::Offset { distance, cases } = &ops[0] else {
            panic!("expected Offset");
        };
        assert!((distance.as_lit().unwrap() - (-0.2)).abs() < 1e-9);
        assert_eq!(cases.len(), 2);
        assert_eq!(cases[0].selector, OffsetSelector::Inside);
        assert_eq!(cases[0].rule, "Glass");
        assert_eq!(cases[1].selector, OffsetSelector::Border);
        assert_eq!(cases[1].rule, "Frame");
    }

    #[test]
    fn test_parse_offset_is_terminating() {
        assert!(parse_ops("Offset(-0.1) { Inside: A } Scale(1, 2, 1)").is_err());
    }

    // ── Feature: Roof ────────────────────────────────────────────────────────

    #[test]
    fn test_parse_roof_gable_no_overhang() {
        let ops = parse_ops("Roof(Gable, 30) { Slope: Tiles | GableEnd: Bricks }").unwrap();
        assert_eq!(ops.len(), 1);
        let ShapeOp::Roof { spec, cases } = &ops[0] else {
            panic!("expected Roof");
        };
        assert_eq!(spec.roof_type, RoofType::Gable);
        assert!((spec.pitch.as_lit().unwrap() - 30.0).abs() < 1e-9);
        assert!(spec.overhang.as_lit().unwrap().abs() < 1e-9);
        assert_eq!(cases.len(), 2);
        assert_eq!(cases[0].selector, RoofFaceSelector::Slope);
        assert_eq!(cases[1].selector, RoofFaceSelector::GableEnd);
    }

    #[test]
    fn test_parse_roof_hip_with_overhang() {
        let ops = parse_ops("Roof(Hip, 45, 0.5) { Slope: Tiles }").unwrap();
        let ShapeOp::Roof { spec, .. } = &ops[0] else {
            panic!("expected Roof");
        };
        assert_eq!(spec.roof_type, RoofType::Hip);
        assert!((spec.pitch.as_lit().unwrap() - 45.0).abs() < 1e-9);
        assert!((spec.overhang.as_lit().unwrap() - 0.5).abs() < 1e-9);
    }

    #[test]
    fn test_parse_roof_angle_out_of_range_rejected() {
        assert!(parse_ops("Roof(Gable, 0) { Slope: Tiles }").is_err());
        assert!(parse_ops("Roof(Gable, 90) { Slope: Tiles }").is_err());
    }

    #[test]
    fn test_parse_roof_is_terminating() {
        assert!(parse_ops("Roof(Shed, 30) { Slope: Tiles } Scale(1, 2, 1)").is_err());
    }
}