@danielsimonjr/mathts-plot 0.3.48 → 0.4.1

package/dist/index.js

@@ -1117,7 +1117,7 @@ function curve3d(x, y, z, opts = {}) {
 }
 
 // src/index.ts
-var VERSION = "0.3.48";
+var VERSION = "0.4.1";
 export {
   VERSION,
   area,

package/dist/render-file.d.ts

@@ -9,9 +9,6 @@ interface RenderOptions {
     timeoutMs?: number;
     density?: number;
     background?: string;
-    /** Enable LaTeX \write18 shell-escape. UNSAFE for untrusted TeX — allows
-     *  arbitrary command execution during compile. Default false. */
-    shellEscape?: boolean;
 }
 interface RunResult {
     code: number | null;
@@ -30,10 +27,9 @@ declare function hasTool(name: string): Promise<boolean>;
  *  the SVG through; `.png`/`.pdf` convert via rsvg-convert (preferred) or resvg.
  *  Rejects with PlotRenderError naming the tool to install if none is present. */
 declare function renderToFile(svg: string, outPath: string, opts?: RenderOptions): Promise<void>;
-/** Build the CLI args for a LaTeX engine. Shell-escape (\write18) is OFF unless
- *  `shellEscape` is true — enabling it is UNSAFE for untrusted TeX (arbitrary
- *  command execution during compile). */
-declare function latexArgs(engine: string, workDir: string, texPath: string, shellEscape: boolean): string[];
+/** Build the CLI args for a LaTeX engine. Shell-escape (\write18) is OFF
+ *  for security (arbitrary command execution during compile). */
+declare function latexArgs(engine: string, workDir: string, texPath: string): string[];
 /** Standalone LaTeX/TikZ source → PDF via pdflatex (preferred) or tectonic.
  *  Compiles in an OS temp dir and copies the resulting PDF to `outPath`.
  *  Rejects with PlotRenderError naming the engine to install if none is found. */

package/dist/render-file.js

@@ -11,8 +11,13 @@ var PlotRenderError = class extends Error {
   }
   missingTool;
 };
+var ALLOWED_TOOLS = ["rsvg-convert", "resvg", "pdflatex", "xelatex", "lualatex", "tectonic"];
 function runTool(cmd, args, opts = {}) {
   return new Promise((resolve, reject) => {
+    if (!ALLOWED_TOOLS.includes(cmd)) {
+      reject(new PlotRenderError(`Security Error: Execution of tool '${cmd}' is not allowed.`));
+      return;
+    }
     const child = spawn(cmd, args, { timeout: opts.timeoutMs ?? 3e4 });
     const out = [];
     let err = "";
@@ -39,6 +44,9 @@ async function hasTool(name) {
   }
 }
 async function renderToFile(svg, outPath, opts = {}) {
+  if (opts.tool && !ALLOWED_TOOLS.includes(opts.tool)) {
+    throw new PlotRenderError(`Security Error: Execution of tool '${opts.tool}' is not allowed.`);
+  }
   const ext = extname(outPath).toLowerCase();
   if (ext === ".svg") {
     await writeFile(outPath, svg, "utf-8");
@@ -94,12 +102,12 @@ async function renderToFile(svg, outPath, opts = {}) {
     "rsvg-convert"
   );
 }
-function latexArgs(engine, workDir, texPath, shellEscape) {
+function latexArgs(engine, workDir, texPath) {
   if (engine === "tectonic") {
-    return [...shellEscape ? ["-Z", "shell-escape"] : [], "--outdir", workDir, texPath];
+    return ["--outdir", workDir, texPath];
   }
   return [
-    shellEscape ? "-shell-escape" : "-no-shell-escape",
+    "-no-shell-escape",
     "-interaction=nonstopmode",
     "-halt-on-error",
     "-output-directory",
@@ -108,6 +116,9 @@ function latexArgs(engine, workDir, texPath, shellEscape) {
   ];
 }
 async function latexToPdf(texSource, outPath, opts = {}) {
+  if (opts.tool && !ALLOWED_TOOLS.includes(opts.tool)) {
+    throw new PlotRenderError(`Security Error: Execution of tool '${opts.tool}' is not allowed.`);
+  }
   if (extname(outPath).toLowerCase() !== ".pdf") {
     throw new PlotRenderError(`latexToPdf output must be a .pdf path (got '${outPath}')`);
   }
@@ -129,7 +140,7 @@ async function latexToPdf(texSource, outPath, opts = {}) {
   try {
     const texPath = joinPath(work, "doc.tex");
     await writeFile(texPath, texSource, "utf-8");
-    const args = latexArgs(engine, work, texPath, opts.shellEscape === true);
+    const args = latexArgs(engine, work, texPath);
     const r = await runTool(engine, args, { timeoutMs: opts.timeoutMs ?? 6e4 });
     const pdfPath = joinPath(work, "doc.pdf");
     let pdf;

package/package.json

@@ -1,70 +1,70 @@
-{
-  "name": "@danielsimonjr/mathts-plot",
-  "version": "0.3.48",
-  "description": "Headless SVG 2D/3D plotting for MathTS — dependency-light, expression-aware, built on core/functions/expression",
-  "author": "Daniel Simon Jr.",
-  "license": "MIT",
-  "type": "module",
-  "main": "./dist/index.js",
-  "module": "./dist/index.js",
-  "types": "./dist/index.d.ts",
-  "exports": {
-    ".": {
-      "import": "./dist/index.js",
-      "types": "./dist/index.d.ts"
-    },
-    "./render": {
-      "import": "./dist/render-file.js",
-      "types": "./dist/render-file.d.ts"
-    }
-  },
-  "files": [
-    "dist",
-    "README.md"
-  ],
-  "scripts": {
-    "build": "tsup",
-    "dev": "tsup --watch",
-    "test": "vitest run",
-    "test:watch": "vitest",
-    "test:coverage": "vitest run --coverage",
-    "typecheck": "tsc --noEmit",
-    "lint": "eslint src --ext .ts",
-    "lint:fix": "eslint src --ext .ts --fix",
-    "clean": "rm -rf dist"
-  },
-  "dependencies": {
-    "@danielsimonjr/mathts-core": "^0.13.1",
-    "@danielsimonjr/mathts-functions": "^0.61.0",
-    "@danielsimonjr/mathts-expression": "^0.6.7"
-  },
-  "devDependencies": {
-    "@types/node": "^25.5.2",
-    "tsup": "^8.0.0",
-    "typescript": "^5.3.0",
-    "vitest": "^4.1.5"
-  },
-  "publishConfig": {
-    "access": "public"
-  },
-  "repository": {
-    "type": "git",
-    "url": "https://github.com/danielsimonjr/mathts",
-    "directory": "plot"
-  },
-  "keywords": [
-    "math",
-    "typescript",
-    "plot",
-    "plotting",
-    "chart",
-    "svg",
-    "2d",
-    "3d",
-    "surface",
-    "contour",
-    "heatmap",
-    "visualization",
-    "headless"
-  ]
-}
+{
+  "name": "@danielsimonjr/mathts-plot",
+  "version": "0.4.1",
+  "description": "Headless SVG 2D/3D plotting for MathTS — dependency-light, expression-aware, built on core/functions/expression",
+  "author": "Daniel Simon Jr.",
+  "license": "MIT",
+  "type": "module",
+  "main": "./dist/index.js",
+  "module": "./dist/index.js",
+  "types": "./dist/index.d.ts",
+  "exports": {
+    ".": {
+      "import": "./dist/index.js",
+      "types": "./dist/index.d.ts"
+    },
+    "./render": {
+      "import": "./dist/render-file.js",
+      "types": "./dist/render-file.d.ts"
+    }
+  },
+  "files": [
+    "dist",
+    "README.md"
+  ],
+  "scripts": {
+    "build": "tsup",
+    "dev": "tsup --watch",
+    "test": "vitest run",
+    "test:watch": "vitest",
+    "test:coverage": "vitest run --coverage",
+    "typecheck": "tsc --noEmit",
+    "lint": "eslint src --ext .ts",
+    "lint:fix": "eslint src --ext .ts --fix",
+    "clean": "rm -rf dist"
+  },
+  "dependencies": {
+    "@danielsimonjr/mathts-core": "^0.14.1",
+    "@danielsimonjr/mathts-functions": "^0.63.0",
+    "@danielsimonjr/mathts-expression": "^0.7.1"
+  },
+  "devDependencies": {
+    "@types/node": "^25.5.2",
+    "tsup": "^8.0.0",
+    "typescript": "^5.3.0",
+    "vitest": "^4.1.10"
+  },
+  "publishConfig": {
+    "access": "public"
+  },
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/danielsimonjr/MathTS.git",
+    "directory": "plot"
+  },
+  "keywords": [
+    "math",
+    "typescript",
+    "plot",
+    "plotting",
+    "chart",
+    "svg",
+    "2d",
+    "3d",
+    "surface",
+    "contour",
+    "heatmap",
+    "visualization",
+    "headless"
+  ]
+}