fix: align filter coercion and YAML flow-map parsing across PHP and JS

[felipesauer]

Summary

An audit surfaced four behaviors that either diverged between the PHP and TypeScript packages — breaking the library's cross-language parity guarantee — or were incorrect in both. Each was confirmed by running real code on PHP 8.3 and Node 24. All fixes are mirrored symmetrically and locked by identical parity tests.

• Filter numeric literals now coerce identically: only plain decimal integers and decimal floats (incl. scientific notation) become numbers; hex (0x1A), binary (0b101), octal (0o17), and underscore-grouped literals stay strings in both runtimes. Integral values such as 1e3 collapse to an integer so they compare equal to integer data under strict equality. (Before: [?v == 1e3] matched 1000 in PHP but 1 in JS.)
• Relational operators (>, <, >=, <=) compare only when both operands are numbers; any other type yields false. This removes the "abc" > 5 (PHP true / JS false) and "" >= 0 (PHP false / JS true) divergences. ==/!= are unchanged (already strict).
• YAML flow maps split on the first colon outside quotes and unquote quoted keys, so {"a:b": v} parses to { "a:b": "v" } instead of corrupting the key/value pair.
• YAML merge keys (<<) are now rejected inside flow maps ({<<: {a: 1}}), closing a gap in the documented "merge keys are blocked" guarantee.
• Path cache key is normalized by stripping the optional root prefix, so $.a.b, $a.b, and a.b share one cache entry instead of three.
• Documented that nested flow collections are not expanded by the minimal YAML parser (intentional, mirrored in both runtimes).

Behavioral changes worth noting

Filter predicates with hex/binary/octal literals (JS only) previously coerced to numbers and now stay strings; relational comparisons against numeric-looking string field values now return false in both runtimes (use arithmetic, e.g. @.v * 1 > 5, to compare them numerically).

Validation

• cd packages/php && composer test — 673 passed, 100% line coverage
• cd packages/php && composer analyse — PHPStan: no errors
• cd packages/php && composer test:mutation — Infection MSI 100% / Covered MSI 100%
• cd packages/js && npm test — 1839 passed
• cd packages/js && npx tsc --noEmit && npx eslint src/ tests/ — clean
• cd packages/js && npm run test:mutation — Stryker score 94.28% (≥ 93% break threshold)
• Both parity suites (ParityTest.php, parity.test.ts) — 59 identical cross-language tests, green

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.

📢 Thoughts on this report? Let us know!