@blaxel/core 0.3.20-preview.286 → 0.3.20-preview.289

package/dist/cjs/common/env.js

@@ -4,16 +4,32 @@ var __importDefault = (this && this.__importDefault) || function (mod) {
 };
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.env = void 0;
-const toml_1 = __importDefault(require("toml"));
+const smol_toml_1 = __importDefault(require("smol-toml"));
 const node_js_1 = require("./node.js");
-const secretEnv = {};
-const configEnv = {};
+const hasOwn = (source, prop) => Object.prototype.hasOwnProperty.call(source, prop);
+const secretEnv = Object.create(null);
+const configEnv = Object.create(null);
+const stringifyTomlEnvValue = (value) => {
+    if (typeof value === "string") {
+        return value;
+    }
+    if (typeof value === "number" || typeof value === "boolean" || typeof value === "bigint") {
+        return String(value);
+    }
+    if (value instanceof Date) {
+        return value.toISOString();
+    }
+    const serialized = JSON.stringify(value);
+    return serialized === undefined ? String(value) : serialized;
+};
 if (node_js_1.fs !== null) {
     try {
         const configFile = node_js_1.fs.readFileSync("blaxel.toml", "utf8");
-        const configInfos = toml_1.default.parse(configFile);
-        for (const key in configInfos.env) {
-            configEnv[key] = configInfos.env[key];
+        const configInfos = smol_toml_1.default.parse(configFile, { maxDepth: 100 });
+        if (configInfos.env && typeof configInfos.env === "object") {
+            for (const [key, value] of Object.entries(configInfos.env)) {
+                configEnv[key] = stringifyTomlEnvValue(value);
+            }
         }
     }
     catch {
@@ -42,13 +58,13 @@ if (node_js_1.fs !== null) {
 }
 const env = new Proxy({}, {
     get: (target, prop) => {
-        if (secretEnv[prop]) {
+        if (hasOwn(secretEnv, prop)) {
             return secretEnv[prop];
         }
-        if (configEnv[prop]) {
+        if (hasOwn(configEnv, prop)) {
             return configEnv[prop];
         }
-        if (typeof process !== "undefined" && process.env) {
+        if (typeof process !== "undefined" && process.env && hasOwn(process.env, prop)) {
             return process.env[prop];
         }
         return undefined;

package/dist/cjs/common/env.test.js

@@ -0,0 +1,139 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+const node_fs_1 = require("node:fs");
+const node_os_1 = require("node:os");
+const node_path_1 = require("node:path");
+const smol_toml_1 = __importDefault(require("smol-toml"));
+const vitest_1 = require("vitest");
+const originalCwd = process.cwd();
+const originalWorkspace = process.env.BL_WORKSPACE;
+let currentTempDir;
+const importEnvFromTempConfig = async (config) => {
+    currentTempDir = (0, node_fs_1.mkdtempSync)((0, node_path_1.join)((0, node_os_1.tmpdir)(), "blaxel-env-"));
+    (0, node_fs_1.writeFileSync)((0, node_path_1.join)(currentTempDir, "blaxel.toml"), config);
+    process.chdir(currentTempDir);
+    vitest_1.vi.resetModules();
+    return Promise.resolve().then(() => __importStar(require("./env.js")));
+};
+(0, vitest_1.afterEach)(() => {
+    process.chdir(originalCwd);
+    if (originalWorkspace === undefined) {
+        delete process.env.BL_WORKSPACE;
+    }
+    else {
+        process.env.BL_WORKSPACE = originalWorkspace;
+    }
+    delete Object.prototype.BL_WORKSPACE;
+    delete Object.prototype.SECRET_ENV;
+    vitest_1.vi.resetModules();
+    if (currentTempDir) {
+        (0, node_fs_1.rmSync)(currentTempDir, { force: true, recursive: true });
+        currentTempDir = undefined;
+    }
+});
+(0, vitest_1.describe)("env TOML configuration", () => {
+    (0, vitest_1.it)("loads blaxel.toml env values through the SDK env proxy", async () => {
+        const { env } = await importEnvFromTempConfig(`
+[env]
+BL_WORKSPACE = "test-workspace"
+BL_API_URL = "https://api.example.test"
+`);
+        (0, vitest_1.expect)(env.BL_WORKSPACE).toBe("test-workspace");
+        (0, vitest_1.expect)(env.BL_API_URL).toBe("https://api.example.test");
+    });
+    (0, vitest_1.it)("serializes supported TOML env value types through the SDK env proxy", async () => {
+        const { env } = await importEnvFromTempConfig(`
+[env]
+BOOLEAN_VALUE = true
+NUMBER_VALUE = 42
+ARRAY_VALUE = ["a", "b"]
+INLINE_TABLE_VALUE = { name = "sandbox", enabled = true }
+MULTILINE_VALUE = """
+line one
+line two
+"""
+`);
+        (0, vitest_1.expect)(env.BOOLEAN_VALUE).toBe("true");
+        (0, vitest_1.expect)(env.NUMBER_VALUE).toBe("42");
+        (0, vitest_1.expect)(env.ARRAY_VALUE).toBe('["a","b"]');
+        (0, vitest_1.expect)(env.INLINE_TABLE_VALUE).toBe('{"name":"sandbox","enabled":true}');
+        (0, vitest_1.expect)(env.MULTILINE_VALUE).toBe("line one\nline two\n");
+    });
+    (0, vitest_1.it)("bounds array and inline-table nesting in the selected TOML parser", () => {
+        const nestedArray = `value = ${"[".repeat(6)}0${"]".repeat(6)}`;
+        const nestedInlineTable = `value = ${"{ a = ".repeat(6)}0${"}".repeat(6)}`;
+        (0, vitest_1.expect)(() => smol_toml_1.default.parse(nestedArray, { maxDepth: 5 })).toThrow(/excessively nested structures/);
+        (0, vitest_1.expect)(() => smol_toml_1.default.parse(nestedInlineTable, { maxDepth: 5 })).toThrow(/excessively nested structures/);
+    });
+    (0, vitest_1.it)("uses the SDK loader bounded TOML parser for default config parsing", async () => {
+        process.env.BL_WORKSPACE = "process-workspace";
+        const nestedArray = `${"[".repeat(101)}0${"]".repeat(101)}`;
+        const { env } = await importEnvFromTempConfig(`
+[env]
+BL_WORKSPACE = "toml-workspace"
+TOO_DEEP = ${nestedArray}
+`);
+        (0, vitest_1.expect)(env.BL_WORKSPACE).toBe("process-workspace");
+    });
+    (0, vitest_1.it)("does not load inherited env keys from config or secret sources", async () => {
+        delete process.env.BL_WORKSPACE;
+        Object.prototype.BL_WORKSPACE = "polluted-workspace";
+        Object.prototype.SECRET_ENV = "polluted-secret";
+        const { env } = await importEnvFromTempConfig(`
+[env]
+LEGITIMATE_ENV = "kept"
+`);
+        (0, vitest_1.expect)(env.BL_WORKSPACE).toBeUndefined();
+        (0, vitest_1.expect)(env.SECRET_ENV).toBeUndefined();
+        (0, vitest_1.expect)(env.LEGITIMATE_ENV).toBe("kept");
+    });
+    (0, vitest_1.it)("does not pollute prototypes while loading malicious TOML env keys", async () => {
+        delete process.env.BL_WORKSPACE;
+        const { env } = await importEnvFromTempConfig(`
+[env]
+BL_WORKSPACE = "legitimate-workspace"
+
+[env.__proto__]
+INJECTED = "polluted-workspace"
+`);
+        (0, vitest_1.expect)(env.BL_WORKSPACE).toBe("legitimate-workspace");
+        (0, vitest_1.expect)(env.INJECTED).toBeUndefined();
+        (0, vitest_1.expect)(Object.prototype).not.toHaveProperty("INJECTED");
+    });
+});

package/dist/cjs/common/settings.js

@@ -30,8 +30,8 @@ function missingCredentialsMessage() {
     return "No Blaxel credentials found. Set the BL_API_KEY and BL_WORKSPACE environment variables, or run `bl login`.";
 }
 // Build info - these placeholders are replaced at build time by build:replace-imports
-const BUILD_VERSION = "0.3.20-preview.286";
-const BUILD_COMMIT = "6ebbd206e01759209b37771835096c6500d9fbb9";
+const BUILD_VERSION = "0.3.20-preview.289";
+const BUILD_COMMIT = "58aa51d749f749507d5fee77ee0393ec7d9c4753";
 const BUILD_SENTRY_DSN = "https://fd5e60e1c9820e1eef5ccebb84a07127@o4508714045276160.ingest.us.sentry.io/4510465864564736";
 const BLAXEL_API_VERSION = "2026-04-28";
 // Bun < 1.3.11 never sends connection-level WINDOW_UPDATE: the pooled h2

package/dist/cjs/types/common/env.test.d.ts

@@ -0,0 +1 @@
+export {};