@venn-lang/cli 0.1.0 → 0.1.2

package/dist/cli.mjs

@@ -1454,6 +1454,29 @@ function readBare(cur) {
 	const num = Number(raw);
 	return raw !== "" && !Number.isNaN(num) ? num : raw;
 }
+/**
+* Keys that reach the prototype rather than the object.
+*
+* A manifest is data that arrives with somebody else's project, and assigning
+* one of these from it changes how every object in the process behaves. A
+* `venn.toml` containing `[package.__proto__]` was enough to put a property on
+* `Object.prototype`.
+*/
+const RESERVED$1 = /* @__PURE__ */ new Set([
+	"__proto__",
+	"constructor",
+	"prototype"
+]);
+/**
+* Whether a key read from a manifest may be assigned.
+*
+* @param key The key exactly as it was written in the file.
+* @returns `false` for a key that would reach the prototype, which the caller
+* should skip rather than assign.
+*/
+function isSafeKey(key) {
+	return !RESERVED$1.has(key);
+}
 /** The table `[path]` names, created along the way if it is not there yet. */
 function enterSection(root, path) {
 	let node = root;
@@ -1481,7 +1504,7 @@ function enterTableArray(root, path) {
 	return table;
 }
 function keysOf$1(path) {
-	return path.split(".").map((part) => part.trim().replace(/^["']|["']$/g, "")).filter((part) => part !== "");
+	return path.split(".").map((part) => part.trim().replace(/^["']|["']$/g, "")).filter((part) => part !== "" && isSafeKey(part));
 }
 /**
 * A TOML reader for `venn.toml`: sections, nested `[a.b]`, arrays of tables
@@ -1522,6 +1545,7 @@ function assign(section, line) {
 	const eq = line.indexOf("=");
 	if (eq < 0) return;
 	const key = line.slice(0, eq).trim().replace(/^["']|["']$/g, "");
+	if (!isSafeKey(key)) return;
 	section[key] = readValue(cursor(line.slice(eq + 1)));
 }
 /**
@@ -9462,9 +9486,9 @@ function addNoneTerminalToCst(node, ruleName, ruleResult) {
 }
 //#endregion
 //#region ../../node_modules/.pnpm/chevrotain@12.0.0/node_modules/chevrotain/lib/src/lang/lang_extensions.js
-const NAME = "name";
+const NAME$1 = "name";
 function defineNameProp(obj, nameValue) {
-	Object.defineProperty(obj, NAME, {
+	Object.defineProperty(obj, NAME$1, {
 		enumerable: false,
 		configurable: true,
 		writable: false,
@@ -55970,20 +55994,41 @@ function isPlugin(value) {
 }
 //#endregion
 //#region src/upgrade/version.ts
+/** The manifest to accept, so a neighbour's is never read by mistake. */
+const NAME = "@venn-lang/cli";
+/** Where the manifest sits relative to this file, in a release and in the tree. */
+const CANDIDATES = [
+	"../package.json",
+	"../../package.json",
+	"../../../package.json"
+];
 /**
 * The version of the CLI that is running.
 *
 * Read from the package manifest rather than written into the source, so a
-* release cannot ship a binary that reports the version before it. The manifest
-* sits one level above the bundle, which is true both in `dist` and in `src`
-* during development.
+* release cannot ship a binary that reports the version before it.
+*
+* The path is searched rather than assumed. The bundle flattens
+* `src/upgrade/version.ts` into `dist/cli.mjs`, so the manifest is two levels up
+* while developing and one in a release; assuming either one reports `0.0.0` to
+* everybody living with the other, and the name check keeps the search from
+* settling on some other package's manifest on the way up.
 */
 const VERSION = read();
 function read() {
+	const require = createRequire(import.meta.url);
+	for (const path of CANDIDATES) {
+		const version = versionAt(require, path);
+		if (version) return version;
+	}
+	return "0.0.0";
+}
+function versionAt(require, path) {
 	try {
-		return createRequire(import.meta.url)("../../package.json").version ?? "0.0.0";
+		const manifest = require(path);
+		return manifest.name === NAME ? manifest.version : void 0;
 	} catch {
-		return "0.0.0";
+		return;
 	}
 }
 //#endregion

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@venn-lang/cli",
-  "version": "0.1.0",
+  "version": "0.1.2",
   "description": "The venn binary: one command for starting, checking, running and testing a Venn project.",
   "keywords": [
     "venn",
@@ -41,17 +41,17 @@
   },
   "dependencies": {
     "citty": "^0.2.2",
-    "@venn-lang/assert": "0.1.0",
-    "@venn-lang/contracts": "0.1.0",
-    "@venn-lang/core": "0.1.0",
-    "@venn-lang/dts": "0.1.0",
-    "@venn-lang/http": "0.1.0",
-    "@venn-lang/io": "0.1.0",
-    "@venn-lang/project": "0.1.0",
-    "@venn-lang/runtime": "0.1.0",
-    "@venn-lang/sdk": "0.1.0",
-    "@venn-lang/stdlib": "0.1.0",
-    "@venn-lang/types": "0.1.0"
+    "@venn-lang/assert": "0.1.2",
+    "@venn-lang/contracts": "0.1.2",
+    "@venn-lang/core": "0.1.2",
+    "@venn-lang/dts": "0.1.2",
+    "@venn-lang/http": "0.1.2",
+    "@venn-lang/io": "0.1.2",
+    "@venn-lang/project": "0.1.2",
+    "@venn-lang/runtime": "0.1.2",
+    "@venn-lang/sdk": "0.1.2",
+    "@venn-lang/stdlib": "0.1.2",
+    "@venn-lang/types": "0.1.2"
   },
   "devDependencies": {
     "@types/node": "^24",

package/src/upgrade/version.ts

@@ -1,21 +1,39 @@
 import { createRequire } from "node:module";
 
+/** The manifest to accept, so a neighbour's is never read by mistake. */
+const NAME = "@venn-lang/cli";
+
+/** Where the manifest sits relative to this file, in a release and in the tree. */
+const CANDIDATES = ["../package.json", "../../package.json", "../../../package.json"];
+
 /**
  * The version of the CLI that is running.
  *
  * Read from the package manifest rather than written into the source, so a
- * release cannot ship a binary that reports the version before it. The manifest
- * sits one level above the bundle, which is true both in `dist` and in `src`
- * during development.
+ * release cannot ship a binary that reports the version before it.
+ *
+ * The path is searched rather than assumed. The bundle flattens
+ * `src/upgrade/version.ts` into `dist/cli.mjs`, so the manifest is two levels up
+ * while developing and one in a release; assuming either one reports `0.0.0` to
+ * everybody living with the other, and the name check keeps the search from
+ * settling on some other package's manifest on the way up.
  */
 export const VERSION: string = read();
 
 function read(): string {
+  const require = createRequire(import.meta.url);
+  for (const path of CANDIDATES) {
+    const version = versionAt(require, path);
+    if (version) return version;
+  }
+  return "0.0.0";
+}
+
+function versionAt(require: ReturnType<typeof createRequire>, path: string): string | undefined {
   try {
-    const require = createRequire(import.meta.url);
-    const manifest = require("../../package.json") as { version?: string };
-    return manifest.version ?? "0.0.0";
+    const manifest = require(path) as { name?: string; version?: string };
+    return manifest.name === NAME ? manifest.version : undefined;
   } catch {
-    return "0.0.0";
+    return undefined;
   }
 }