safeExpression.ts

/**
 * Evaluates a numeric expression with + - * / parentheses only.
 * No eval/Function — safe for untrusted-looking editor input.
 */
export function evaluateSafeNumericExpression(raw: string): number {
  const s = raw.trim().replace(/;$/, "").trim();
  if (!s) throw new Error("Empty expression");

  let i = 0;

  const peek = () => s[i];
  const eat = (c?: string) => {
    while (peek() === " ") i++;
    if (c !== undefined && peek() !== c) {
      throw new Error(`Expected '${c}' at position ${i}`);
    }
    if (c !== undefined) i++;
  };

  const readNumber = (): number => {
    eat();
    const start = i;
    while (/\d/.test(peek() ?? "")) i++;
    if (peek() === ".") {
      i++;
      while (/\d/.test(peek() ?? "")) i++;
    }
    const slice = s.slice(start, i).trim();
    if (!slice || slice === "-") throw new Error("Invalid number");
    const n = Number(slice);
    if (!Number.isFinite(n)) throw new Error("Invalid number");
    return n;
  };

  const parseFactor = (): number => {
    eat();
    if (peek() === "(") {
      eat("(");
      const v = parseExpr();
      eat(")");
      return v;
    }
    if (peek() === "-") {
      i++;
      return -parseFactor();
    }
    return readNumber();
  };

  const parseTerm = (): number => {
    let v = parseFactor();
    eat();
    while (peek() === "*" || peek() === "/") {
      const op = peek()!;
      i++;
      const rhs = parseFactor();
      v = op === "*" ? v * rhs : v / rhs;
      eat();
    }
    return v;
  };

  const parseExpr = (): number => {
    let v = parseTerm();
    eat();
    while (peek() === "+" || peek() === "-") {
      const op = peek()!;
      i++;
      const rhs = parseTerm();
      v = op === "+" ? v + rhs : v - rhs;
      eat();
    }
    return v;
  };

  const result = parseExpr();
  eat();
  if (i < s.length) {
    throw new Error(`Unexpected character '${peek()}' at position ${i}`);
  }
  return result;
}