@cornerstonejs/metadata 5.13.2 → 5.15.0

package/dist/esm/safeFunctions/expression/expression.test.js

@@ -0,0 +1,325 @@
+import { collectIdentifiers, collectReads, compileExpression, ExpressionSyntaxError, parseExpressionSource, } from './index.js';
+describe('compileExpression', () => {
+    describe('literals and operators', () => {
+        it('evaluates arithmetic and precedence', () => {
+            expect(compileExpression('1 + 2 * 3')()).toBe(7);
+            expect(compileExpression('(1 + 2) * 3')()).toBe(9);
+            expect(compileExpression('10 % 3')()).toBe(1);
+            expect(compileExpression('-4 + 1')()).toBe(-3);
+        });
+        it('parses exponent notation', () => {
+            expect(compileExpression('1e3')()).toBe(1000);
+            expect(compileExpression('2.5E-3')()).toBe(0.0025);
+            expect(compileExpression('1e+2 + 1')()).toBe(101);
+            expect(() => compileExpression('1 e')).toThrow(ExpressionSyntaxError);
+        });
+        it('rejects malformed numbers', () => {
+            expect(() => compileExpression('1.2.3')).toThrow(/Invalid number/);
+        });
+        it('evaluates comparisons and logic', () => {
+            expect(compileExpression('1 < 2 && 3 >= 3')()).toBe(true);
+            expect(compileExpression('1 == 1 || false')()).toBe(true);
+            expect(compileExpression('!true')()).toBe(false);
+            expect(compileExpression("'a' != 'b'")()).toBe(true);
+        });
+        it('has one equality: === and !== are compile errors', () => {
+            expect(() => compileExpression('1 === 1')).toThrow(/'===' is not allowed; use '=='/);
+            expect(() => compileExpression('1 !== 1')).toThrow(/'!==' is not allowed/);
+            expect(compileExpression("'2' == 2")()).toBe(true);
+        });
+        it('gives + the type of its left operand: text joins, a number adds', () => {
+            const run = (source, scope = {}) => compileExpression(source)(scope);
+            expect(run("'2' + 3")).toBe('23');
+            expect(run("3 + '2'")).toBe(5);
+            expect(run("0 + '2' + 3")).toBe(5);
+            expect(run("'' + Rows + 'x' + Columns", { Rows: 512, Columns: 256 })).toBe('512x256');
+            expect(run("'b=' + B")).toBe('b=');
+            expect(run('B + 5')).toBeUndefined();
+            expect(run("'' + B + 5")).toBe('5');
+            expect(run('5 + B')).toBeUndefined();
+        });
+        it('warns for a number plus text, and rejects text in - * / %', () => {
+            const warn = jest
+                .spyOn(console, 'warn')
+                .mockImplementation(() => undefined);
+            expect(compileExpression("Rows + 'x'")({ Rows: 512 })).toBeUndefined();
+            expect(warn).toHaveBeenCalledTimes(1);
+            warn.mockRestore();
+            expect(() => compileExpression("Rows - 'x'")).toThrow(/'-'.*'x'/);
+            expect(() => compileExpression('Rows * `x`')).toThrow(/a template literal is not a number/);
+        });
+        it('gives the literal tests the DICOM kinds of a value', () => {
+            const tests = [
+                'X == undefined',
+                'X == null',
+                'X == defined',
+                'X != undefined',
+            ].map((source) => compileExpression(source));
+            const row = (X) => tests.map((test) => test({ X }));
+            expect(row(undefined)).toEqual([true, true, false, false]);
+            expect(row(null)).toEqual([false, true, false, true]);
+            expect(row('')).toEqual([false, true, false, true]);
+            expect(row([])).toEqual([false, true, false, true]);
+            expect(row([''])).toEqual([false, true, false, true]);
+            expect(row([null])).toEqual([false, true, false, true]);
+            expect(row('CT')).toEqual([false, false, true, true]);
+            expect(compileExpression('X != defined')({ X: '' })).toBe(true);
+        });
+        it('compares two values with no value by kind: null is not undefined', () => {
+            const equal = compileExpression('Y == Z');
+            expect(equal({ Y: null })).toBe(false);
+            expect(equal({ Z: null })).toBe(false);
+            expect(equal({ Y: null, Z: '' })).toBe(false);
+            expect(equal({ Y: null, Z: null })).toBe(true);
+            expect(equal({})).toBe(true);
+        });
+        it('accepts defined only as an operand of == and !=', () => {
+            expect(() => compileExpression('defined')).toThrow(/'defined' is a literal/);
+            expect(() => compileExpression('defined(X)')).toThrow(ExpressionSyntaxError);
+        });
+        it('gives false for an ordering comparison with no value, and reads a numeric string as a number', () => {
+            const greater = compileExpression('X > 1');
+            expect([undefined, null, '', [], 'a'].map((X) => greater({ X }))).toEqual([false, false, false, false, false]);
+            expect(greater({ X: '2' })).toBe(true);
+            expect(compileExpression('X <= 0')({ X: null })).toBe(false);
+        });
+        it('compares text without case with lower()', () => {
+            const fn = compileExpression("lower(BodyPartExamined) == 'breast'");
+            expect(fn({ BodyPartExamined: 'BREAST' })).toBe(true);
+            expect(fn({})).toBe(false);
+        });
+        it('evaluates ternaries', () => {
+            expect(compileExpression('1 < 2 ? "yes" : "no"')()).toBe('yes');
+        });
+        it('evaluates membership with in', () => {
+            const fn = compileExpression("Modality in ['CR', 'DX', 'MG']");
+            expect(fn({ Modality: 'MG' })).toBe(true);
+            expect(fn({ Modality: 'CT' })).toBe(false);
+        });
+        it('reads == as the whole value: a scalar equals an array of one element, and two arrays are equal in order', () => {
+            const equal = compileExpression('X == Y');
+            const CASES = [
+                ['MR', ['MR'], true],
+                [['MR', 'CT'], ['MR', 'CT'], true],
+                [['CT', 'MR'], ['MR', 'CT'], false],
+                [['ORIGINAL', 'LOCALIZER'], 'LOCALIZER', false],
+                ['MR', ['MR', 'CT'], false],
+            ];
+            for (const [X, Y, expected] of CASES) {
+                expect([X, Y, equal({ X, Y })]).toEqual([X, Y, expected]);
+            }
+            expect(compileExpression("X == ['MR']")({ X: 'MR' })).toBe(true);
+            expect(compileExpression("X in ['MR', 'CT']")({ X: 'MR' })).toBe(true);
+            expect(compileExpression("'LOCALIZER' in X")({ X: ['ORIGINAL', 'LOCALIZER'] })).toBe(true);
+        });
+        it('refuses == and != with an array literal of two or more values, and names in', () => {
+            for (const source of [
+                "Modality == ['MR', 'CT']",
+                "['MR', 'CT'] == Modality",
+                "Modality != ['MR', 'CT']",
+            ]) {
+                expect(() => compileExpression(source)).toThrow(/use .*in \[\.\.\.\]/);
+            }
+            expect(() => compileExpression("Modality == ['MR']")).not.toThrow();
+        });
+        it('refuses an empty array literal next to ==', () => {
+            expect(() => compileExpression('X != []')).toThrow(/accepts no value/);
+        });
+    });
+    describe('scope resolution', () => {
+        it('resolves bare identifiers against the first argument', () => {
+            const fn = compileExpression("Modality == 'CT' && Rows > 0");
+            expect(fn({ Modality: 'CT', Rows: 512 })).toBe(true);
+            expect(fn({ Modality: 'MR', Rows: 512 })).toBe(false);
+        });
+        it('resolves named parameters', () => {
+            const fn = compileExpression('context.series.mixedBValue');
+            expect(fn({}, { series: { mixedBValue: true } })).toBe(true);
+        });
+        it('supports custom parameter names', () => {
+            const fn = compileExpression('items.length', { params: ['items'] });
+            expect(fn([1, 2, 3])).toBe(3);
+            const fn2 = compileExpression('instances.length');
+            expect(fn2({ instances: [1, 2, 3] })).toBe(3);
+        });
+        it('reads the implicit scope from a named parameter', () => {
+            const fn = compileExpression('SliceLocation', {
+                params: ['a', 'b'],
+                implicitScope: 'b',
+            });
+            expect(fn({ SliceLocation: 1 }, { SliceLocation: 2 })).toBe(2);
+            expect(() => compileExpression('x', { params: ['a'], implicitScope: 'c' })).toThrow(/implicitScope 'c' is not one of the parameters \(a\)/);
+        });
+        it('refuses a bare identifier that is not a parameter with no implicit scope', () => {
+            const options = { params: ['a', 'b', 'context'], implicitScope: false };
+            const fn = compileExpression('a.SliceLocation - b.SliceLocation', options);
+            expect(fn({ SliceLocation: 5 }, { SliceLocation: 2 })).toBe(3);
+            expect(() => compileExpression('SliceLocation - b.SliceLocation', options)).toThrow(ExpressionSyntaxError);
+            expect(() => compileExpression('SliceLocation - b.SliceLocation', options)).toThrow(/'SliceLocation' is not a parameter.*\(a, b, context\)/);
+            expect(() => compileExpression('a[Key]', options)).toThrow(/'Key'/);
+            expect(() => compileExpression('`${Name}`', options)).toThrow(/'Name'/);
+        });
+        it('lets an aggregate argument read the element with no implicit scope', () => {
+            const fn = compileExpression('series.instances.count(Rows > 1)', {
+                params: ['items'],
+                implicitScope: false,
+                receivers: { series: 'items' },
+            });
+            expect(fn([{ Rows: 2 }, { Rows: 0 }])).toBe(1);
+            expect(() => compileExpression('Rows + series.instances.count()', {
+                params: ['items'],
+                implicitScope: false,
+                receivers: { series: 'items' },
+            })).toThrow(/'Rows' is not a parameter/);
+        });
+        it('returns undefined for unknown identifiers (sparse tags)', () => {
+            const fn = compileExpression('DiffusionBValue != undefined');
+            expect(fn({})).toBe(false);
+            expect(fn({ DiffusionBValue: 800 })).toBe(true);
+        });
+    });
+    describe('template literals', () => {
+        it('builds strings with interpolations', () => {
+            const fn = compileExpression('`${SeriesDescription} #${InstanceNumber}`');
+            expect(fn({ SeriesDescription: 'AX T1', InstanceNumber: 3 })).toBe('AX T1 #3');
+        });
+        it('renders null/undefined interpolations as empty strings', () => {
+            const fn = compileExpression('`SCOUT ${SeriesDescription}`');
+            expect(fn({})).toBe('SCOUT ');
+        });
+    });
+    describe('helpers and aggregates', () => {
+        it('gives includes, contains, startsWith and endsWith the meaning of the operators', () => {
+            const run = (source, ImageType) => compileExpression(source)({ ImageType });
+            expect(run("includes(ImageType, 'M')", 'MR')).toBe(false);
+            expect(run("includes(ImageType, 'LOCALIZER')", ['ORIGINAL', 'LOCALIZER'])).toBe(true);
+            expect(run("contains(ImageType, 'LOCAL')", ['ORIGINAL', 'LOCALIZER'])).toBe(true);
+            expect(run("startsWith(ImageType, 'ORIG')", ['ORIGINAL', 'PRIMARY'])).toBe(true);
+            expect(run("endsWith(ImageType, 'ARY')", ['ORIGINAL', 'PRIMARY'])).toBe(true);
+            expect(run('ImageType == defined', [''])).toBe(false);
+        });
+        it('reads no value as undefined in arithmetic, and a numeric string as a number', () => {
+            const run = (source, A) => compileExpression(source)({ A });
+            expect(run('A - 1', '3')).toBe(2);
+            expect(run('Number(A) + 1', '2')).toBe(3);
+            expect(run('A * 512', null)).toBeUndefined();
+            expect(run('A - 1', '')).toBeUndefined();
+            expect(run('-A', undefined)).toBeUndefined();
+        });
+        it('reads no value as false in !, && and ||, and gives a boolean', () => {
+            const run = (source, A) => compileExpression(source)({ A });
+            expect(run('!A', [])).toBe(true);
+            expect(run('A && A > 1000', undefined)).toBe(false);
+            expect(run("A || 'x'", 'y')).toBe(true);
+        });
+        it('returns undefined for min/max with no number, and skips a missing value', () => {
+            expect(compileExpression('min()')()).toBeUndefined();
+            expect(compileExpression('max(undefined, null)')()).toBeUndefined();
+            expect(compileExpression('min(3, 1, 2)')()).toBe(1);
+            expect(compileExpression('max(3, null, 2)')()).toBe(3);
+            expect(compileExpression('round(x)')({})).toBeUndefined();
+        });
+        it('runs min, max, sum and count over the list of the receiver', () => {
+            const over = { params: ['list'], receivers: { series: 'list' } };
+            const list = [
+                { DiffusionBValue: 800, NumberOfFrames: '2' },
+                { DiffusionBValue: null },
+                { DiffusionBValue: 0, NumberOfFrames: 4 },
+            ];
+            const run = (source) => compileExpression(`series.instances.${source}`, over)(list);
+            expect(run('count()')).toBe(3);
+            expect(run('count(DiffusionBValue)')).toBe(2);
+            expect(run('count(DiffusionBValue > 100)')).toBe(1);
+            expect(run('sum(NumberOfFrames)')).toBe(6);
+            expect(run('min(DiffusionBValue)')).toBe(0);
+            expect(run('max(NumberOfFrames)')).toBe(4);
+            expect(compileExpression('series.instances.sum(x)', over)([])).toBe(0);
+            expect(compileExpression('series.instances.max(x)', over)([])).toBeUndefined();
+        });
+        it('refuses an aggregate inside the argument of an aggregate', () => {
+            const over = { params: ['list'], receivers: { series: 'list' } };
+            expect(() => compileExpression('series.instances.max(Rows - series.instances.min(Rows))', over)).toThrow(/own context entry/);
+        });
+    });
+    describe('safety', () => {
+        it('rejects prototype-chain access at parse time', () => {
+            expect(() => compileExpression('a.__proto__')).toThrow(ExpressionSyntaxError);
+            expect(() => compileExpression('a.constructor')).toThrow(ExpressionSyntaxError);
+            expect(() => compileExpression('a.prototype.x')).toThrow(ExpressionSyntaxError);
+            expect(() => compileExpression('__proto__')).toThrow(ExpressionSyntaxError);
+        });
+        it('blocks computed prototype access at runtime', () => {
+            const fn = compileExpression('a[key]');
+            expect(fn({ a: {}, key: 'constructor' })).toBeUndefined();
+        });
+        it('rejects non-whitelisted calls at compile time', () => {
+            expect(() => compileExpression('alert(1)')).toThrow(ExpressionSyntaxError);
+            expect(() => compileExpression('a.toString()')).toThrow(ExpressionSyntaxError);
+        });
+        it('rejects malformed expressions with the source in the message', () => {
+            expect(() => compileExpression('1 +')).toThrow(/1 \+/);
+            expect(() => compileExpression('`unterminated')).toThrow(ExpressionSyntaxError);
+        });
+        it('resolves null/undefined property access in templates to an empty string without throwing', () => {
+            const warn = jest
+                .spyOn(console, 'warn')
+                .mockImplementation(() => undefined);
+            try {
+                const fn = compileExpression('`${a.b.c}`');
+                expect(fn({})).toBe('');
+            }
+            finally {
+                warn.mockRestore();
+            }
+        });
+    });
+    describe('collectIdentifiers', () => {
+        const identifiersOf = (source) => collectIdentifiers(parseExpressionSource(source)).sort();
+        it('collects the identifiers an expression resolves against its scope', () => {
+            expect(identifiersOf("Modality == 'CT' && Rows > 512")).toEqual([
+                'Modality',
+                'Rows',
+            ]);
+        });
+        it('collects only the root of a member or index chain', () => {
+            expect(identifiersOf('instance.ViewCodeSequence[0].CodeValue')).toEqual([
+                'instance',
+            ]);
+            expect(identifiersOf('instance.Sequence[Offset]')).toEqual([
+                'Offset',
+                'instance',
+            ]);
+        });
+        it('does not collect helper or aggregate callees', () => {
+            expect(identifiersOf('round(Rows / 64)')).toEqual(['Rows']);
+            expect(identifiersOf('max(InstanceNumber)')).toEqual(['InstanceNumber']);
+        });
+        it('reaches into templates, ternaries and arrays', () => {
+            expect(identifiersOf('`${SeriesDescription} ${Modality}`')).toEqual([
+                'Modality',
+                'SeriesDescription',
+            ]);
+            expect(identifiersOf('Rows > 2000 ? Big : Small')).toEqual([
+                'Big',
+                'Rows',
+                'Small',
+            ]);
+            expect(identifiersOf("Modality in [Primary, 'CT']")).toEqual([
+                'Modality',
+                'Primary',
+            ]);
+        });
+        it('reports the field of a path and the reads inside an aggregate', () => {
+            expect(collectReads(parseExpressionSource('round(sweepStart - timeClusters.first) + series.instances.max(Rows)'), { aggregates: true })).toEqual([
+                { name: 'sweepStart', inAggregate: false },
+                { name: 'timeClusters', field: 'first', inAggregate: false },
+                { name: 'Rows', inAggregate: true },
+            ]);
+        });
+        it('lets a host spot an identifier it does not supply', () => {
+            const supplied = new Set(['Modality', 'Rows', 'instance', 'context']);
+            const unknown = identifiersOf("Modallity == 'CT' && Rows > 0").filter((name) => !supplied.has(name));
+            expect(unknown).toEqual(['Modallity']);
+        });
+    });
+});

package/dist/esm/safeFunctions/expression/index.d.ts

@@ -0,0 +1,4 @@
+export { collectIdentifiers, collectReads, compileExpression, ExpressionSyntaxError, type CompiledExpression, type CompileExpressionOptions, type ExpressionRead, } from './compiler.js';
+export { parseExpressionSource, FORBIDDEN_PROPERTIES } from './parser.js';
+export type { ExpressionNode } from './parser.js';
+export { tokenize } from './tokenizer.js';

package/dist/esm/safeFunctions/expression/index.js

@@ -0,0 +1,3 @@
+export { collectIdentifiers, collectReads, compileExpression, ExpressionSyntaxError, } from './compiler.js';
+export { parseExpressionSource, FORBIDDEN_PROPERTIES } from './parser.js';
+export { tokenize } from './tokenizer.js';

package/dist/esm/safeFunctions/expression/parser.d.ts

@@ -0,0 +1,56 @@
+export type ExpressionNode = {
+    type: 'literal';
+    value: unknown;
+} | {
+    type: 'identifier';
+    name: string;
+} | {
+    type: 'member';
+    object: ExpressionNode;
+    property: string;
+} | {
+    type: 'index';
+    object: ExpressionNode;
+    index: ExpressionNode;
+} | {
+    type: 'call';
+    callee: string;
+    args: ExpressionNode[];
+    receiver?: string;
+} | {
+    type: 'unary';
+    operator: '!' | '-' | '+';
+    argument: ExpressionNode;
+} | {
+    type: 'binary';
+    operator: string;
+    left: ExpressionNode;
+    right: ExpressionNode;
+} | {
+    type: 'logical';
+    operator: '&&' | '||';
+    left: ExpressionNode;
+    right: ExpressionNode;
+} | {
+    type: 'conditional';
+    test: ExpressionNode;
+    consequent: ExpressionNode;
+    alternate: ExpressionNode;
+} | {
+    type: 'array';
+    elements: ExpressionNode[];
+} | {
+    type: 'template';
+    parts: Array<{
+        kind: 'text';
+        text: string;
+    } | {
+        kind: 'expr';
+        node: ExpressionNode;
+    }>;
+};
+export declare const FORBIDDEN_PROPERTIES: Set<string>;
+export declare const DEFINED_LITERAL: unique symbol;
+export declare const AGGREGATE_NAMES: Set<string>;
+export declare const AGGREGATE_RECEIVERS: Set<string>;
+export declare function parseExpressionSource(source: string, expression?: string): ExpressionNode;

package/dist/esm/safeFunctions/expression/parser.js

@@ -0,0 +1,248 @@
+import { ExpressionSyntaxError, tokenize } from './tokenizer.js';
+export const FORBIDDEN_PROPERTIES = new Set([
+    '__proto__',
+    'prototype',
+    'constructor',
+]);
+export const DEFINED_LITERAL = Symbol('defined');
+const KEYWORD_LITERALS = new Map([
+    ['true', true],
+    ['false', false],
+    ['null', null],
+    ['undefined', undefined],
+    ['defined', DEFINED_LITERAL],
+]);
+const BINARY_PRECEDENCE = {
+    '||': 1,
+    '&&': 2,
+    '==': 3,
+    '!=': 3,
+    '===': 3,
+    '!==': 3,
+    '<': 4,
+    '<=': 4,
+    '>': 4,
+    '>=': 4,
+    in: 4,
+    '+': 5,
+    '-': 5,
+    '*': 6,
+    '/': 6,
+    '%': 6,
+};
+export const AGGREGATE_NAMES = new Set(['min', 'max', 'sum', 'count']);
+export const AGGREGATE_RECEIVERS = new Set([
+    'series',
+    'displaySet',
+    'displaySets',
+]);
+function aggregateReceiver(node) {
+    if (node.type === 'member' &&
+        AGGREGATE_NAMES.has(node.property) &&
+        node.object.type === 'member' &&
+        node.object.property === 'instances' &&
+        node.object.object.type === 'identifier' &&
+        AGGREGATE_RECEIVERS.has(node.object.object.name)) {
+        return node.object.object.name;
+    }
+    return undefined;
+}
+class Parser {
+    constructor(source, expression) {
+        this.position = 0;
+        this.expression = expression;
+        this.tokens = tokenize(source, expression);
+    }
+    peek() {
+        return this.tokens[this.position];
+    }
+    next() {
+        return this.tokens[this.position++];
+    }
+    isPunct(value) {
+        const token = this.peek();
+        return token.kind === 'punct' && token.value === value;
+    }
+    isIdent(name) {
+        const token = this.peek();
+        return token.kind === 'ident' && token.name === name;
+    }
+    expectPunct(value) {
+        if (!this.isPunct(value)) {
+            throw new ExpressionSyntaxError(`Expected '${value}'`, this.expression);
+        }
+        this.next();
+    }
+    fail(message) {
+        throw new ExpressionSyntaxError(message, this.expression);
+    }
+    parse() {
+        const node = this.parseConditional();
+        if (this.peek().kind !== 'end') {
+            this.fail('Unexpected trailing input');
+        }
+        return node;
+    }
+    parseSubExpression() {
+        return this.parseConditional();
+    }
+    parseConditional() {
+        const test = this.parseBinary(0);
+        if (!this.isPunct('?')) {
+            return test;
+        }
+        this.next();
+        const consequent = this.parseConditional();
+        this.expectPunct(':');
+        const alternate = this.parseConditional();
+        return { type: 'conditional', test, consequent, alternate };
+    }
+    parseBinary(minPrecedence) {
+        let left = this.parseUnary();
+        for (;;) {
+            const token = this.peek();
+            let operator;
+            if (token.kind === 'punct' && BINARY_PRECEDENCE[token.value]) {
+                operator = token.value;
+            }
+            else if (token.kind === 'ident' && token.name === 'in') {
+                operator = 'in';
+            }
+            if (!operator) {
+                return left;
+            }
+            const precedence = BINARY_PRECEDENCE[operator];
+            if (precedence <= minPrecedence) {
+                return left;
+            }
+            this.next();
+            const right = this.parseBinary(precedence);
+            left =
+                operator === '&&' || operator === '||'
+                    ? { type: 'logical', operator, left, right }
+                    : { type: 'binary', operator, left, right };
+        }
+    }
+    parseUnary() {
+        const token = this.peek();
+        if (token.kind === 'punct' &&
+            (token.value === '!' || token.value === '-' || token.value === '+')) {
+            this.next();
+            return {
+                type: 'unary',
+                operator: token.value,
+                argument: this.parseUnary(),
+            };
+        }
+        return this.parsePostfix();
+    }
+    parsePostfix() {
+        let node = this.parsePrimary();
+        for (;;) {
+            if (this.isPunct('.')) {
+                this.next();
+                const property = this.next();
+                if (property.kind !== 'ident') {
+                    this.fail("Expected a property name after '.'");
+                }
+                if (FORBIDDEN_PROPERTIES.has(property.name)) {
+                    this.fail(`Access to '${property.name}' is not allowed`);
+                }
+                node = { type: 'member', object: node, property: property.name };
+                continue;
+            }
+            if (this.isPunct('[')) {
+                this.next();
+                const index = this.parseSubExpression();
+                this.expectPunct(']');
+                node = { type: 'index', object: node, index };
+                continue;
+            }
+            if (this.isPunct('(')) {
+                const receiver = aggregateReceiver(node);
+                if (node.type !== 'identifier' && !receiver) {
+                    this.fail('Only whitelisted helper functions may be called');
+                }
+                const callee = node.type === 'identifier'
+                    ? node.name
+                    : node.property;
+                this.next();
+                const args = [];
+                if (!this.isPunct(')')) {
+                    for (;;) {
+                        args.push(this.parseSubExpression());
+                        if (this.isPunct(',')) {
+                            this.next();
+                            continue;
+                        }
+                        break;
+                    }
+                }
+                this.expectPunct(')');
+                node = receiver
+                    ? { type: 'call', callee, args, receiver }
+                    : { type: 'call', callee, args };
+                continue;
+            }
+            return node;
+        }
+    }
+    parsePrimary() {
+        const token = this.next();
+        if (token.kind === 'number') {
+            return { type: 'literal', value: token.value };
+        }
+        if (token.kind === 'string') {
+            return { type: 'literal', value: token.value };
+        }
+        if (token.kind === 'template') {
+            return {
+                type: 'template',
+                parts: token.parts.map((part) => part.kind === 'text'
+                    ? part
+                    : {
+                        kind: 'expr',
+                        node: parseExpressionSource(part.source, this.expression),
+                    }),
+            };
+        }
+        if (token.kind === 'ident') {
+            if (KEYWORD_LITERALS.has(token.name)) {
+                return { type: 'literal', value: KEYWORD_LITERALS.get(token.name) };
+            }
+            if (token.name === 'in') {
+                this.fail("Unexpected 'in'");
+            }
+            if (FORBIDDEN_PROPERTIES.has(token.name)) {
+                this.fail(`Access to '${token.name}' is not allowed`);
+            }
+            return { type: 'identifier', name: token.name };
+        }
+        if (token.kind === 'punct') {
+            if (token.value === '(') {
+                const node = this.parseSubExpression();
+                this.expectPunct(')');
+                return node;
+            }
+            if (token.value === '[') {
+                const elements = [];
+                if (!this.isPunct(']')) {
+                    for (;;) {
+                        elements.push(this.parseSubExpression());
+                        if (this.isPunct(',')) {
+                            this.next();
+                            continue;
+                        }
+                        break;
+                    }
+                }
+                this.expectPunct(']');
+                return { type: 'array', elements };
+            }
+        }
+        this.fail('Unexpected token');
+    }
+}
+export function parseExpressionSource(source, expression = source) {
+    return new Parser(source, expression).parse();
+}

package/dist/esm/safeFunctions/expression/tokenizer.d.ts

@@ -0,0 +1,29 @@
+export type Token = {
+    kind: 'number';
+    value: number;
+} | {
+    kind: 'string';
+    value: string;
+} | {
+    kind: 'template';
+    parts: TemplatePart[];
+} | {
+    kind: 'ident';
+    name: string;
+} | {
+    kind: 'punct';
+    value: string;
+} | {
+    kind: 'end';
+};
+export type TemplatePart = {
+    kind: 'text';
+    text: string;
+} | {
+    kind: 'expr';
+    source: string;
+};
+export declare class ExpressionSyntaxError extends Error {
+    constructor(message: string, expression: string);
+}
+export declare function tokenize(source: string, expression?: string): Token[];