@danielsimonjr/mathts-workbook 0.3.22 → 0.3.24

package/dist/{chunk-3KTM2DZC.js → chunk-M2K7SQG2.js}

@@ -4,6 +4,11 @@ var POLLUTION_KEYS = /* @__PURE__ */ new Set(["__proto__", "constructor", "proto
 function parseYamlHardened(content) {
   return parseYaml(content, { schema: "core", merge: false, logLevel: "silent" });
 }
+function parseYamlSafe(content) {
+  const value = parseYamlHardened(content);
+  assertNoPollution(value);
+  return value;
+}
 function isPlainObject(value) {
   return typeof value === "object" && value !== null && !Array.isArray(value);
 }
@@ -15,6 +20,10 @@ function findPollutionKeys(value, seen = /* @__PURE__ */ new WeakSet(), found =
     for (const item of value) findPollutionKeys(item, seen, found);
     return found;
   }
+  const proto = Object.getPrototypeOf(value);
+  if (proto !== Object.prototype && proto !== null) {
+    found.push("__proto__");
+  }
   for (const key of Object.getOwnPropertyNames(value)) {
     if (POLLUTION_KEYS.has(key)) {
       found.push(key);
@@ -172,7 +181,14 @@ var IDENTIFIER_RE = /^[A-Za-z_][A-Za-z0-9_]*$/;
 function isValidIdentifier(id) {
   return typeof id === "string" && IDENTIFIER_RE.test(id);
 }
-var SUPPORTED_CELL_TYPES = ["code", "markdown", "data", "test", "equation", "visualization"];
+var SUPPORTED_CELL_TYPES = [
+  "code",
+  "markdown",
+  "data",
+  "test",
+  "equation",
+  "visualization"
+];
 var EXECUTION_MODES = ["reactive", "sequential", "manual"];
 function detectCellType(cell) {
   for (const key of CELL_TYPE_KEYS) {
@@ -210,9 +226,7 @@ function mapCell(raw, index, errors) {
     errors.push(`Cell at index ${index}: missing "id"`);
     id = `#${index}`;
   } else if (typeof rawId !== "string" || !IDENTIFIER_RE.test(rawId)) {
-    errors.push(
-      `Cell "${String(rawId)}": id must be a valid identifier ([A-Za-z_][A-Za-z0-9_]*)`
-    );
+    errors.push(`Cell "${String(rawId)}": id must be a valid identifier ([A-Za-z_][A-Za-z0-9_]*)`);
     id = String(rawId);
   } else {
     id = rawId;
@@ -360,11 +374,18 @@ function importWorkbook(input) {
   try {
     obj = parseYamlHardened(input);
   } catch (error) {
-    return { success: false, errors: [`Invalid JSON/YAML: ${error instanceof Error ? error.message : String(error)}`] };
+    return {
+      success: false,
+      errors: [`Invalid JSON/YAML: ${error instanceof Error ? error.message : String(error)}`]
+    };
   }
   if (!obj || typeof obj !== "object" || Array.isArray(obj)) {
     return { success: false, errors: ['Input must be an object with a "cells" array'] };
   }
+  const pollution = findPollutionKeys(obj);
+  if (pollution.length > 0) {
+    return { success: false, errors: [`Disallowed key "${pollution[0]}" (prototype pollution)`] };
+  }
   const root = obj;
   if (!Array.isArray(root.cells)) {
     return { success: false, errors: ['Input must have a "cells" array'] };
@@ -556,8 +577,7 @@ var WorkbookExecutor = class {
    * parser, so both YAML entry points are consistent.
    */
   async executeData(cell) {
-    const value = parseYamlHardened(cell.content);
-    assertNoPollution(value);
+    const value = parseYamlSafe(cell.content);
     return value;
   }
   /**
@@ -699,7 +719,7 @@ function formatResult(value) {
 }
 
 export {
-  parseYamlHardened,
+  parseYamlSafe,
   buildDependencyGraph,
   topologicalSort,
   getDependents,

package/dist/{chunk-57X3SQL6.js → chunk-RKUVI3F6.js}

@@ -8,7 +8,7 @@ import {
   isValidIdentifier,
   parseWorkbook,
   serializeWorkbook
-} from "./chunk-3KTM2DZC.js";
+} from "./chunk-M2K7SQG2.js";
 
 // src/fs-atomic.ts
 import { writeFileSync, renameSync, unlinkSync } from "fs";
@@ -321,7 +321,7 @@ var Session = class {
 
 // src/contract.ts
 var SCHEMA_VERSION = { major: 1, minor: 0 };
-var VERSION = "0.3.18";
+var VERSION = "0.3.24";
 var COMMAND_NAMES = [
   "run",
   "describe",

package/dist/cli.js

@@ -15,7 +15,7 @@ import {
   runWorkbookWithTimeout,
   setMetadata,
   writeFileAtomic
-} from "./chunk-57X3SQL6.js";
+} from "./chunk-RKUVI3F6.js";
 import {
   buildDependencyGraph,
   createExecutor,
@@ -23,12 +23,12 @@ import {
   formatResult,
   importWorkbook,
   parseWorkbook,
-  parseYamlHardened,
+  parseYamlSafe,
   serializeWorkbook,
   stripOutputs,
   toDOT,
   toMermaid
-} from "./chunk-3KTM2DZC.js";
+} from "./chunk-M2K7SQG2.js";
 
 // src/cli.ts
 import { readFileSync, writeFileSync, lstatSync, realpathSync } from "fs";
@@ -51,14 +51,19 @@ function sanitizeHrefRaw(href) {
     probe = decodeURIComponent(probe);
   } catch {
   }
-  probe = probe.trim().toLowerCase();
   if (probe.startsWith("//")) return null;
-  if (probe.startsWith("http://") || probe.startsWith("https://") || probe.startsWith("mailto:"))
-    return h;
-  if (probe.startsWith("/") || probe.startsWith("./") || probe.startsWith("../") || probe.startsWith("#"))
-    return h;
-  if (/^[a-z][a-z0-9+.-]*:/.test(probe)) return null;
-  return null;
+  try {
+    const url = new URL(probe);
+    if (url.protocol === "http:" || url.protocol === "https:" || url.protocol === "mailto:") {
+      return h;
+    }
+    return null;
+  } catch {
+    if (probe.startsWith("/") || probe.startsWith("./") || probe.startsWith("../") || probe.startsWith("#")) {
+      return h;
+    }
+    return null;
+  }
 }
 function sanitizeHref(href) {
   const raw = sanitizeHrefRaw(href);
@@ -872,7 +877,7 @@ function validateChartSpecs(workbook) {
     if (cell.type !== "visualization") continue;
     let spec;
     try {
-      spec = parseYamlHardened(cell.content);
+      spec = parseYamlSafe(cell.content);
     } catch (error) {
       problems.push(`Cell "${cell.id}": invalid chart spec (${errMessage(error)})`);
       continue;
@@ -1082,7 +1087,7 @@ function buildRenderDoc(workbook, byId, format = "svg") {
     if (c.type === "visualization") {
       rc.type = "chart";
       try {
-        const spec = parseYamlHardened(c.content);
+        const spec = parseYamlSafe(c.content);
         const rendered = renderChart(
           { type: spec?.type, title: spec?.title, xLabel: spec?.x?.label, yLabel: spec?.y?.label },
           lookup(spec?.x?.data),

package/dist/index.js

@@ -11,7 +11,7 @@ import {
   renameCell,
   runWorkbookWithTimeout,
   setMetadata
-} from "./chunk-57X3SQL6.js";
+} from "./chunk-RKUVI3F6.js";
 import {
   WorkbookExecutor,
   buildDependencyGraph,
@@ -26,7 +26,7 @@ import {
   stripOutputs,
   toMermaid,
   topologicalSort
-} from "./chunk-3KTM2DZC.js";
+} from "./chunk-M2K7SQG2.js";
 export {
   SCHEMA_VERSION,
   Session,

package/dist/run-worker.js

@@ -2,7 +2,7 @@ import {
   createExecutor,
   formatResult,
   parseWorkbook
-} from "./chunk-3KTM2DZC.js";
+} from "./chunk-M2K7SQG2.js";
 
 // src/run-worker.ts
 import { parentPort, workerData } from "worker_threads";

package/package.json

@@ -1,64 +1,64 @@
-{
-  "name": "@danielsimonjr/mathts-workbook",
-  "version": "0.3.22",
-  "description": "Scientific workbook runtime for MathTS (.mtsw format)",
-  "author": "Daniel Simon Jr.",
-  "license": "MIT",
-  "type": "module",
-  "main": "./dist/index.js",
-  "module": "./dist/index.js",
-  "types": "./dist/index.d.ts",
-  "bin": {
-    "mtsw": "./dist/cli.js"
-  },
-  "exports": {
-    ".": {
-      "import": "./dist/index.js",
-      "types": "./dist/index.d.ts"
-    }
-  },
-  "files": [
-    "dist",
-    "README.md"
-  ],
-  "scripts": {
-    "build": "tsup",
-    "dev": "tsup --watch",
-    "test": "vitest run",
-    "test:watch": "vitest",
-    "test:coverage": "vitest run --coverage",
-    "typecheck": "tsc --noEmit",
-    "lint": "eslint src --ext .ts",
-    "lint:fix": "eslint src --ext .ts --fix",
-    "clean": "rm -rf dist",
-    "build:prod": "tsup --minify --treeshake"
-  },
-  "dependencies": {
-    "@danielsimonjr/mathts-core": "^0.13.1",
-    "@danielsimonjr/mathts-expression": "^0.6.7",
-    "@danielsimonjr/mathts-functions": "^0.61.0",
-    "@danielsimonjr/mathts-plot": "^0.3.48",
-    "yaml": "^2.3.0"
-  },
-  "devDependencies": {
-    "@types/node": "^25.5.2",
-    "tsup": "^8.0.0",
-    "typescript": "^5.3.0",
-    "vitest": "^4.1.5"
-  },
-  "publishConfig": {
-    "access": "public"
-  },
-  "repository": {
-    "type": "git",
-    "url": "https://github.com/danielsimonjr/mathts",
-    "directory": "workbook"
-  },
-  "keywords": [
-    "notebook",
-    "workbook",
-    "scientific-computing",
-    "reactive",
-    "yaml"
-  ]
-}
+{
+  "name": "@danielsimonjr/mathts-workbook",
+  "version": "0.3.24",
+  "description": "Scientific workbook runtime for MathTS (.mtsw format)",
+  "author": "Daniel Simon Jr.",
+  "license": "MIT",
+  "type": "module",
+  "main": "./dist/index.js",
+  "module": "./dist/index.js",
+  "types": "./dist/index.d.ts",
+  "bin": {
+    "mtsw": "dist/cli.js"
+  },
+  "exports": {
+    ".": {
+      "import": "./dist/index.js",
+      "types": "./dist/index.d.ts"
+    }
+  },
+  "files": [
+    "dist",
+    "README.md"
+  ],
+  "scripts": {
+    "build": "tsup",
+    "dev": "tsup --watch",
+    "test": "vitest run",
+    "test:watch": "vitest",
+    "test:coverage": "vitest run --coverage",
+    "typecheck": "tsc --noEmit",
+    "lint": "eslint src --ext .ts",
+    "lint:fix": "eslint src --ext .ts --fix",
+    "clean": "rm -rf dist",
+    "build:prod": "tsup --minify --treeshake"
+  },
+  "dependencies": {
+    "@danielsimonjr/mathts-core": "^0.14.1",
+    "@danielsimonjr/mathts-expression": "^0.7.1",
+    "@danielsimonjr/mathts-functions": "^0.63.0",
+    "@danielsimonjr/mathts-plot": "^0.4.1",
+    "yaml": "^2.3.0"
+  },
+  "devDependencies": {
+    "@types/node": "^25.5.2",
+    "tsup": "^8.0.0",
+    "typescript": "^5.3.0",
+    "vitest": "^4.1.10"
+  },
+  "publishConfig": {
+    "access": "public"
+  },
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/danielsimonjr/MathTS.git",
+    "directory": "workbook"
+  },
+  "keywords": [
+    "notebook",
+    "workbook",
+    "scientific-computing",
+    "reactive",
+    "yaml"
+  ]
+}