@danielsimonjr/mathts-workbook 0.3.23 → 0.4.0

package/dist/{chunk-3KTM2DZC.js → chunk-M2K7SQG2.js}

@@ -4,6 +4,11 @@ var POLLUTION_KEYS = /* @__PURE__ */ new Set(["__proto__", "constructor", "proto
 function parseYamlHardened(content) {
   return parseYaml(content, { schema: "core", merge: false, logLevel: "silent" });
 }
+function parseYamlSafe(content) {
+  const value = parseYamlHardened(content);
+  assertNoPollution(value);
+  return value;
+}
 function isPlainObject(value) {
   return typeof value === "object" && value !== null && !Array.isArray(value);
 }
@@ -15,6 +20,10 @@ function findPollutionKeys(value, seen = /* @__PURE__ */ new WeakSet(), found =
     for (const item of value) findPollutionKeys(item, seen, found);
     return found;
   }
+  const proto = Object.getPrototypeOf(value);
+  if (proto !== Object.prototype && proto !== null) {
+    found.push("__proto__");
+  }
   for (const key of Object.getOwnPropertyNames(value)) {
     if (POLLUTION_KEYS.has(key)) {
       found.push(key);
@@ -172,7 +181,14 @@ var IDENTIFIER_RE = /^[A-Za-z_][A-Za-z0-9_]*$/;
 function isValidIdentifier(id) {
   return typeof id === "string" && IDENTIFIER_RE.test(id);
 }
-var SUPPORTED_CELL_TYPES = ["code", "markdown", "data", "test", "equation", "visualization"];
+var SUPPORTED_CELL_TYPES = [
+  "code",
+  "markdown",
+  "data",
+  "test",
+  "equation",
+  "visualization"
+];
 var EXECUTION_MODES = ["reactive", "sequential", "manual"];
 function detectCellType(cell) {
   for (const key of CELL_TYPE_KEYS) {
@@ -210,9 +226,7 @@ function mapCell(raw, index, errors) {
     errors.push(`Cell at index ${index}: missing "id"`);
     id = `#${index}`;
   } else if (typeof rawId !== "string" || !IDENTIFIER_RE.test(rawId)) {
-    errors.push(
-      `Cell "${String(rawId)}": id must be a valid identifier ([A-Za-z_][A-Za-z0-9_]*)`
-    );
+    errors.push(`Cell "${String(rawId)}": id must be a valid identifier ([A-Za-z_][A-Za-z0-9_]*)`);
     id = String(rawId);
   } else {
     id = rawId;
@@ -360,11 +374,18 @@ function importWorkbook(input) {
   try {
     obj = parseYamlHardened(input);
   } catch (error) {
-    return { success: false, errors: [`Invalid JSON/YAML: ${error instanceof Error ? error.message : String(error)}`] };
+    return {
+      success: false,
+      errors: [`Invalid JSON/YAML: ${error instanceof Error ? error.message : String(error)}`]
+    };
   }
   if (!obj || typeof obj !== "object" || Array.isArray(obj)) {
     return { success: false, errors: ['Input must be an object with a "cells" array'] };
   }
+  const pollution = findPollutionKeys(obj);
+  if (pollution.length > 0) {
+    return { success: false, errors: [`Disallowed key "${pollution[0]}" (prototype pollution)`] };
+  }
   const root = obj;
   if (!Array.isArray(root.cells)) {
     return { success: false, errors: ['Input must have a "cells" array'] };
@@ -556,8 +577,7 @@ var WorkbookExecutor = class {
    * parser, so both YAML entry points are consistent.
    */
   async executeData(cell) {
-    const value = parseYamlHardened(cell.content);
-    assertNoPollution(value);
+    const value = parseYamlSafe(cell.content);
     return value;
   }
   /**
@@ -699,7 +719,7 @@ function formatResult(value) {
 }
 
 export {
-  parseYamlHardened,
+  parseYamlSafe,
   buildDependencyGraph,
   topologicalSort,
   getDependents,

package/dist/{chunk-UU537RJR.js → chunk-ZVCYWKM5.js}

@@ -8,7 +8,7 @@ import {
   isValidIdentifier,
   parseWorkbook,
   serializeWorkbook
-} from "./chunk-3KTM2DZC.js";
+} from "./chunk-M2K7SQG2.js";
 
 // src/fs-atomic.ts
 import { writeFileSync, renameSync, unlinkSync } from "fs";
@@ -321,7 +321,7 @@ var Session = class {
 
 // src/contract.ts
 var SCHEMA_VERSION = { major: 1, minor: 0 };
-var VERSION = "0.3.23";
+var VERSION = "0.4.0";
 var COMMAND_NAMES = [
   "run",
   "describe",

package/dist/cli.js

@@ -15,7 +15,7 @@ import {
   runWorkbookWithTimeout,
   setMetadata,
   writeFileAtomic
-} from "./chunk-UU537RJR.js";
+} from "./chunk-ZVCYWKM5.js";
 import {
   buildDependencyGraph,
   createExecutor,
@@ -23,14 +23,15 @@ import {
   formatResult,
   importWorkbook,
   parseWorkbook,
-  parseYamlHardened,
+  parseYamlSafe,
   serializeWorkbook,
   stripOutputs,
   toDOT,
   toMermaid
-} from "./chunk-3KTM2DZC.js";
+} from "./chunk-M2K7SQG2.js";
 
 // src/cli.ts
+import { createHash } from "crypto";
 import { readFileSync, writeFileSync, lstatSync, realpathSync } from "fs";
 import { pathToFileURL } from "url";
 import { basename } from "path";
@@ -599,6 +600,7 @@ mtsw - MathTS Workbook CLI
 
 Usage:
   mtsw run <file> [-c <id>] [-v] [--json] [--write] [--timeout <ms>]
+                 [--expect-hash <sha256>]
                                             Execute a workbook (or one cell + its
                                             deps with -c/--cell). -v: events,
                                             --json: machine output, --write: persist
@@ -607,6 +609,8 @@ Usage:
                                             kills it (WorkbookTimeoutError) if it
                                             exceeds the budget \u2014 a runaway cell can't
                                             hang the process. Incompatible with -c/-v.
+                                            --expect-hash refuses to run unless the
+                                            file's SHA-256 matches (optimistic lock).
   mtsw describe <file> [--json]             Structured document model (cells, graph)
   mtsw validate <file> [--json]             Validate structure (ids, deps, cycles)
   mtsw graph <file> [-f mermaid|dot]        Print the dependency graph
@@ -790,6 +794,13 @@ async function runCommand(args) {
   }
   const read = readFile(file);
   if (read.error) return fail([read.error]);
+  const expectHash = flagValue(args, "--expect-hash");
+  if (expectHash !== void 0) {
+    const actual = createHash("sha256").update(read.content, "utf8").digest("hex");
+    if (actual.toLowerCase() !== expectHash.toLowerCase()) {
+      return fail([`--expect-hash mismatch: file SHA-256 is ${actual}, expected ${expectHash}`]);
+    }
+  }
   const parsed = parseWorkbook(read.content);
   if (!parsed.success) {
     const problems2 = parsed.errors ?? [];
@@ -877,7 +888,7 @@ function validateChartSpecs(workbook) {
     if (cell.type !== "visualization") continue;
     let spec;
     try {
-      spec = parseYamlHardened(cell.content);
+      spec = parseYamlSafe(cell.content);
     } catch (error) {
       problems.push(`Cell "${cell.id}": invalid chart spec (${errMessage(error)})`);
       continue;
@@ -1087,7 +1098,7 @@ function buildRenderDoc(workbook, byId, format = "svg") {
     if (c.type === "visualization") {
       rc.type = "chart";
       try {
-        const spec = parseYamlHardened(c.content);
+        const spec = parseYamlSafe(c.content);
         const rendered = renderChart(
           { type: spec?.type, title: spec?.title, xLabel: spec?.x?.label, yLabel: spec?.y?.label },
           lookup(spec?.x?.data),

package/dist/index.d.ts

@@ -431,6 +431,25 @@ interface HandleResult {
 }
 declare function handleRequest(session: Session, request: JsonRpcRequest): Promise<HandleResult>;
 
+/**
+ * MathML → SVG typesetting. Wraps a MathML fragment in an SVG document so
+ * rendered workbooks can emit SVG (browsers, rsvg, inkscape) instead of raw
+ * MathML. The glyph metrics are a conservative estimate — consumers that need
+ * pixel-perfect layout should typeset with a real engine; this is the
+ * no-dependency path the CLI/export uses.
+ */
+interface MathSvgOptions {
+    /** Display (`block`) or inline. Default `block`. */
+    display?: 'block' | 'inline';
+    /** Extra padding in CSS pixels. Default 4. */
+    padding?: number;
+}
+/**
+ * Wrap a MathML fragment (or a full `<math>` document) in an SVG with a
+ * `foreignObject` so the math remains selectable and scalable.
+ */
+declare function mathMLToSVG(mathml: string, options?: MathSvgOptions): string;
+
 /**
  * Shared message/result shapes between `timeout-runner.ts` (the coordinator,
  * running on the caller's thread) and `run-worker.ts` (the `worker_threads`
@@ -480,4 +499,4 @@ declare class WorkbookTimeoutError extends Error {
  */
 declare function runWorkbookWithTimeout(source: string, options: RunWorkbookWithTimeoutOptions): Promise<SerializedRunResult>;
 
-export { type Cell, type CellPosition, type CellResult, type CellType, type ExecutionMode, type ParseResult, type RemoveResult, type RunResult, type RunWorkbookWithTimeoutOptions, type RuntimeConfig, SCHEMA_VERSION, type SerializedCellResult, type SerializedRunResult, Session, VERSION, type Workbook, type WorkbookEvent, WorkbookExecutor, type WorkbookMetadata, WorkbookTimeoutError, addCell, buildDependencyGraph, createExecutor, detectCellType, detectCycles, editCell, formatResult, getAncestors, getDependents, handleRequest, moveCell, parseWorkbook, removeCell, renameCell, runWorkbookWithTimeout, serializeWorkbook, setMetadata, stripOutputs, toMermaid, topologicalSort };
+export { type Cell, type CellPosition, type CellResult, type CellType, type ExecutionMode, type MathSvgOptions, type ParseResult, type RemoveResult, type RunResult, type RunWorkbookWithTimeoutOptions, type RuntimeConfig, SCHEMA_VERSION, type SerializedCellResult, type SerializedRunResult, Session, VERSION, type Workbook, type WorkbookEvent, WorkbookExecutor, type WorkbookMetadata, WorkbookTimeoutError, addCell, buildDependencyGraph, createExecutor, detectCellType, detectCycles, editCell, formatResult, getAncestors, getDependents, handleRequest, mathMLToSVG, moveCell, parseWorkbook, removeCell, renameCell, runWorkbookWithTimeout, serializeWorkbook, setMetadata, stripOutputs, toMermaid, topologicalSort };

package/dist/index.js

@@ -11,7 +11,7 @@ import {
   renameCell,
   runWorkbookWithTimeout,
   setMetadata
-} from "./chunk-UU537RJR.js";
+} from "./chunk-ZVCYWKM5.js";
 import {
   WorkbookExecutor,
   buildDependencyGraph,
@@ -26,7 +26,24 @@ import {
   stripOutputs,
   toMermaid,
   topologicalSort
-} from "./chunk-3KTM2DZC.js";
+} from "./chunk-M2K7SQG2.js";
+
+// src/svg-math.ts
+function mathMLToSVG(mathml, options = {}) {
+  const display = options.display ?? "block";
+  const pad = options.padding ?? 4;
+  const inner = mathml.includes("<math") ? mathml : `<math xmlns="http://www.w3.org/1998/Math/MathML" display="${display}">${mathml}</math>`;
+  const text = inner.replace(/<[^>]+>/g, "");
+  const width = Math.max(24, text.length * 10 + pad * 2);
+  const height = display === "block" ? 36 + pad * 2 : 20 + pad * 2;
+  return [
+    `<svg xmlns="http://www.w3.org/2000/svg" width="${width}" height="${height}" viewBox="0 0 ${width} ${height}">`,
+    `<foreignObject x="${pad}" y="${pad}" width="${width - pad * 2}" height="${height - pad * 2}">`,
+    inner,
+    `</foreignObject>`,
+    `</svg>`
+  ].join("");
+}
 export {
   SCHEMA_VERSION,
   Session,
@@ -43,6 +60,7 @@ export {
   getAncestors,
   getDependents,
   handleRequest,
+  mathMLToSVG,
   moveCell,
   parseWorkbook,
   removeCell,

package/dist/run-worker.js

@@ -2,7 +2,7 @@ import {
   createExecutor,
   formatResult,
   parseWorkbook
-} from "./chunk-3KTM2DZC.js";
+} from "./chunk-M2K7SQG2.js";
 
 // src/run-worker.ts
 import { parentPort, workerData } from "worker_threads";

package/package.json

@@ -1,64 +1,64 @@
-{
-  "name": "@danielsimonjr/mathts-workbook",
-  "version": "0.3.23",
-  "description": "Scientific workbook runtime for MathTS (.mtsw format)",
-  "author": "Daniel Simon Jr.",
-  "license": "MIT",
-  "type": "module",
-  "main": "./dist/index.js",
-  "module": "./dist/index.js",
-  "types": "./dist/index.d.ts",
-  "bin": {
-    "mtsw": "dist/cli.js"
-  },
-  "exports": {
-    ".": {
-      "import": "./dist/index.js",
-      "types": "./dist/index.d.ts"
-    }
-  },
-  "files": [
-    "dist",
-    "README.md"
-  ],
-  "scripts": {
-    "build": "tsup",
-    "dev": "tsup --watch",
-    "test": "vitest run",
-    "test:watch": "vitest",
-    "test:coverage": "vitest run --coverage",
-    "typecheck": "tsc --noEmit",
-    "lint": "eslint src --ext .ts",
-    "lint:fix": "eslint src --ext .ts --fix",
-    "clean": "rm -rf dist",
-    "build:prod": "tsup --minify --treeshake"
-  },
-  "dependencies": {
-    "@danielsimonjr/mathts-core": "^0.14.0",
-    "@danielsimonjr/mathts-expression": "^0.7.0",
-    "@danielsimonjr/mathts-functions": "^0.62.0",
-    "@danielsimonjr/mathts-plot": "^0.4.0",
-    "yaml": "^2.3.0"
-  },
-  "devDependencies": {
-    "@types/node": "^25.5.2",
-    "tsup": "^8.0.0",
-    "typescript": "^5.3.0",
-    "vitest": "^4.1.5"
-  },
-  "publishConfig": {
-    "access": "public"
-  },
-  "repository": {
-    "type": "git",
-    "url": "git+https://github.com/danielsimonjr/MathTS.git",
-    "directory": "workbook"
-  },
-  "keywords": [
-    "notebook",
-    "workbook",
-    "scientific-computing",
-    "reactive",
-    "yaml"
-  ]
-}
+{
+  "name": "@danielsimonjr/mathts-workbook",
+  "version": "0.4.0",
+  "description": "Scientific workbook runtime for MathTS (.mtsw format)",
+  "author": "Daniel Simon Jr.",
+  "license": "MIT",
+  "type": "module",
+  "main": "./dist/index.js",
+  "module": "./dist/index.js",
+  "types": "./dist/index.d.ts",
+  "bin": {
+    "mtsw": "dist/cli.js"
+  },
+  "exports": {
+    ".": {
+      "import": "./dist/index.js",
+      "types": "./dist/index.d.ts"
+    }
+  },
+  "files": [
+    "dist",
+    "README.md"
+  ],
+  "scripts": {
+    "build": "tsup",
+    "dev": "tsup --watch",
+    "test": "vitest run",
+    "test:watch": "vitest",
+    "test:coverage": "vitest run --coverage",
+    "typecheck": "tsc --noEmit",
+    "lint": "eslint src --ext .ts",
+    "lint:fix": "eslint src --ext .ts --fix",
+    "clean": "rm -rf dist",
+    "build:prod": "tsup --minify --treeshake"
+  },
+  "dependencies": {
+    "@danielsimonjr/mathts-core": "^0.14.1",
+    "@danielsimonjr/mathts-expression": "^0.7.1",
+    "@danielsimonjr/mathts-functions": "^0.64.0",
+    "@danielsimonjr/mathts-plot": "^0.4.2",
+    "yaml": "^2.3.0"
+  },
+  "devDependencies": {
+    "@types/node": "^26.2.0",
+    "tsup": "^8.0.0",
+    "typescript": "^5.3.0",
+    "vitest": "^4.1.10"
+  },
+  "publishConfig": {
+    "access": "public"
+  },
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/danielsimonjr/MathTS.git",
+    "directory": "workbook"
+  },
+  "keywords": [
+    "notebook",
+    "workbook",
+    "scientific-computing",
+    "reactive",
+    "yaml"
+  ]
+}