@blaxel/core 0.3.20-preview.288 → 0.3.20-preview.289

package/dist/esm-browser/common/env.js

@@ -1,13 +1,29 @@
-import toml from "toml";
+import toml from "smol-toml";
 import { dotenv, fs } from "./node.js";
-const secretEnv = {};
-const configEnv = {};
+const hasOwn = (source, prop) => Object.prototype.hasOwnProperty.call(source, prop);
+const secretEnv = Object.create(null);
+const configEnv = Object.create(null);
+const stringifyTomlEnvValue = (value) => {
+    if (typeof value === "string") {
+        return value;
+    }
+    if (typeof value === "number" || typeof value === "boolean" || typeof value === "bigint") {
+        return String(value);
+    }
+    if (value instanceof Date) {
+        return value.toISOString();
+    }
+    const serialized = JSON.stringify(value);
+    return serialized === undefined ? String(value) : serialized;
+};
 if (fs !== null) {
     try {
         const configFile = fs.readFileSync("blaxel.toml", "utf8");
-        const configInfos = toml.parse(configFile);
-        for (const key in configInfos.env) {
-            configEnv[key] = configInfos.env[key];
+        const configInfos = toml.parse(configFile, { maxDepth: 100 });
+        if (configInfos.env && typeof configInfos.env === "object") {
+            for (const [key, value] of Object.entries(configInfos.env)) {
+                configEnv[key] = stringifyTomlEnvValue(value);
+            }
         }
     }
     catch {
@@ -36,13 +52,13 @@ if (fs !== null) {
 }
 const env = new Proxy({}, {
     get: (target, prop) => {
-        if (secretEnv[prop]) {
+        if (hasOwn(secretEnv, prop)) {
             return secretEnv[prop];
         }
-        if (configEnv[prop]) {
+        if (hasOwn(configEnv, prop)) {
             return configEnv[prop];
         }
-        if (typeof process !== "undefined" && process.env) {
+        if (typeof process !== "undefined" && process.env && hasOwn(process.env, prop)) {
             return process.env[prop];
         }
         return undefined;

package/dist/esm-browser/common/env.test.js

@@ -1,9 +1,10 @@
 import { mkdtempSync, rmSync, writeFileSync } from "node:fs";
 import { tmpdir } from "node:os";
 import { join } from "node:path";
-import toml from "toml";
+import toml from "smol-toml";
 import { afterEach, describe, expect, it, vi } from "vitest";
 const originalCwd = process.cwd();
+const originalWorkspace = process.env.BL_WORKSPACE;
 let currentTempDir;
 const importEnvFromTempConfig = async (config) => {
     currentTempDir = mkdtempSync(join(tmpdir(), "blaxel-env-"));
@@ -14,6 +15,14 @@ const importEnvFromTempConfig = async (config) => {
 };
 afterEach(() => {
     process.chdir(originalCwd);
+    if (originalWorkspace === undefined) {
+        delete process.env.BL_WORKSPACE;
+    }
+    else {
+        process.env.BL_WORKSPACE = originalWorkspace;
+    }
+    delete Object.prototype.BL_WORKSPACE;
+    delete Object.prototype.SECRET_ENV;
     vi.resetModules();
     if (currentTempDir) {
         rmSync(currentTempDir, { force: true, recursive: true });
@@ -30,10 +39,63 @@ BL_API_URL = "https://api.example.test"
         expect(env.BL_WORKSPACE).toBe("test-workspace");
         expect(env.BL_API_URL).toBe("https://api.example.test");
     });
-    it("uses the bounded TOML parser introduced in toml 4.2.0", () => {
-        const nestedArray = `value = ${"[".repeat(10)}0${"]".repeat(10)}`;
-        expect(() => {
-            toml.parse(nestedArray, { maxDepth: 5 });
-        }).toThrow(/Maximum nesting depth of 5 exceeded/);
+    it("serializes supported TOML env value types through the SDK env proxy", async () => {
+        const { env } = await importEnvFromTempConfig(`
+[env]
+BOOLEAN_VALUE = true
+NUMBER_VALUE = 42
+ARRAY_VALUE = ["a", "b"]
+INLINE_TABLE_VALUE = { name = "sandbox", enabled = true }
+MULTILINE_VALUE = """
+line one
+line two
+"""
+`);
+        expect(env.BOOLEAN_VALUE).toBe("true");
+        expect(env.NUMBER_VALUE).toBe("42");
+        expect(env.ARRAY_VALUE).toBe('["a","b"]');
+        expect(env.INLINE_TABLE_VALUE).toBe('{"name":"sandbox","enabled":true}');
+        expect(env.MULTILINE_VALUE).toBe("line one\nline two\n");
+    });
+    it("bounds array and inline-table nesting in the selected TOML parser", () => {
+        const nestedArray = `value = ${"[".repeat(6)}0${"]".repeat(6)}`;
+        const nestedInlineTable = `value = ${"{ a = ".repeat(6)}0${"}".repeat(6)}`;
+        expect(() => toml.parse(nestedArray, { maxDepth: 5 })).toThrow(/excessively nested structures/);
+        expect(() => toml.parse(nestedInlineTable, { maxDepth: 5 })).toThrow(/excessively nested structures/);
+    });
+    it("uses the SDK loader bounded TOML parser for default config parsing", async () => {
+        process.env.BL_WORKSPACE = "process-workspace";
+        const nestedArray = `${"[".repeat(101)}0${"]".repeat(101)}`;
+        const { env } = await importEnvFromTempConfig(`
+[env]
+BL_WORKSPACE = "toml-workspace"
+TOO_DEEP = ${nestedArray}
+`);
+        expect(env.BL_WORKSPACE).toBe("process-workspace");
+    });
+    it("does not load inherited env keys from config or secret sources", async () => {
+        delete process.env.BL_WORKSPACE;
+        Object.prototype.BL_WORKSPACE = "polluted-workspace";
+        Object.prototype.SECRET_ENV = "polluted-secret";
+        const { env } = await importEnvFromTempConfig(`
+[env]
+LEGITIMATE_ENV = "kept"
+`);
+        expect(env.BL_WORKSPACE).toBeUndefined();
+        expect(env.SECRET_ENV).toBeUndefined();
+        expect(env.LEGITIMATE_ENV).toBe("kept");
+    });
+    it("does not pollute prototypes while loading malicious TOML env keys", async () => {
+        delete process.env.BL_WORKSPACE;
+        const { env } = await importEnvFromTempConfig(`
+[env]
+BL_WORKSPACE = "legitimate-workspace"
+
+[env.__proto__]
+INJECTED = "polluted-workspace"
+`);
+        expect(env.BL_WORKSPACE).toBe("legitimate-workspace");
+        expect(env.INJECTED).toBeUndefined();
+        expect(Object.prototype).not.toHaveProperty("INJECTED");
     });
 });

package/dist/esm-browser/common/settings.js

@@ -24,8 +24,8 @@ function missingCredentialsMessage() {
     return "No Blaxel credentials found. Set the BL_API_KEY and BL_WORKSPACE environment variables, or run `bl login`.";
 }
 // Build info - these placeholders are replaced at build time by build:replace-imports
-const BUILD_VERSION = "0.3.20-preview.288";
-const BUILD_COMMIT = "7691d8c5e7547a821cdf3837fa455b5ba081cc80";
+const BUILD_VERSION = "0.3.20-preview.289";
+const BUILD_COMMIT = "58aa51d749f749507d5fee77ee0393ec7d9c4753";
 const BUILD_SENTRY_DSN = "https://fd5e60e1c9820e1eef5ccebb84a07127@o4508714045276160.ingest.us.sentry.io/4510465864564736";
 const BLAXEL_API_VERSION = "2026-04-28";
 // Bun < 1.3.11 never sends connection-level WINDOW_UPDATE: the pooled h2

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "@blaxel/core",
-	"version": "0.3.20-preview.288",
+	"version": "0.3.20-preview.289",
 	"description": "Blaxel Core SDK for TypeScript",
 	"license": "MIT",
 	"author": "Blaxel, INC (https://blaxel.ai)",
@@ -72,7 +72,7 @@
 		"dotenv": "^17.4.2",
 		"form-data": "^4.0.2",
 		"jwt-decode": "^4.0.0",
-		"toml": "4.2.0",
+		"smol-toml": "^1.8.0",
 		"uuid": "^11.1.0",
 		"ws": "^8.18.2",
 		"yaml": "^2.7.1",