@venn-lang/cli 0.1.1 → 0.1.2

package/dist/cli.mjs

@@ -1454,6 +1454,29 @@ function readBare(cur) {
 	const num = Number(raw);
 	return raw !== "" && !Number.isNaN(num) ? num : raw;
 }
+/**
+* Keys that reach the prototype rather than the object.
+*
+* A manifest is data that arrives with somebody else's project, and assigning
+* one of these from it changes how every object in the process behaves. A
+* `venn.toml` containing `[package.__proto__]` was enough to put a property on
+* `Object.prototype`.
+*/
+const RESERVED$1 = /* @__PURE__ */ new Set([
+	"__proto__",
+	"constructor",
+	"prototype"
+]);
+/**
+* Whether a key read from a manifest may be assigned.
+*
+* @param key The key exactly as it was written in the file.
+* @returns `false` for a key that would reach the prototype, which the caller
+* should skip rather than assign.
+*/
+function isSafeKey(key) {
+	return !RESERVED$1.has(key);
+}
 /** The table `[path]` names, created along the way if it is not there yet. */
 function enterSection(root, path) {
 	let node = root;
@@ -1481,7 +1504,7 @@ function enterTableArray(root, path) {
 	return table;
 }
 function keysOf$1(path) {
-	return path.split(".").map((part) => part.trim().replace(/^["']|["']$/g, "")).filter((part) => part !== "");
+	return path.split(".").map((part) => part.trim().replace(/^["']|["']$/g, "")).filter((part) => part !== "" && isSafeKey(part));
 }
 /**
 * A TOML reader for `venn.toml`: sections, nested `[a.b]`, arrays of tables
@@ -1522,6 +1545,7 @@ function assign(section, line) {
 	const eq = line.indexOf("=");
 	if (eq < 0) return;
 	const key = line.slice(0, eq).trim().replace(/^["']|["']$/g, "");
+	if (!isSafeKey(key)) return;
 	section[key] = readValue(cursor(line.slice(eq + 1)));
 }
 /**

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@venn-lang/cli",
-  "version": "0.1.1",
+  "version": "0.1.2",
   "description": "The venn binary: one command for starting, checking, running and testing a Venn project.",
   "keywords": [
     "venn",
@@ -41,17 +41,17 @@
   },
   "dependencies": {
     "citty": "^0.2.2",
-    "@venn-lang/assert": "0.1.1",
-    "@venn-lang/contracts": "0.1.1",
-    "@venn-lang/core": "0.1.1",
-    "@venn-lang/dts": "0.1.1",
-    "@venn-lang/http": "0.1.1",
-    "@venn-lang/io": "0.1.1",
-    "@venn-lang/project": "0.1.1",
-    "@venn-lang/runtime": "0.1.1",
-    "@venn-lang/sdk": "0.1.1",
-    "@venn-lang/stdlib": "0.1.1",
-    "@venn-lang/types": "0.1.1"
+    "@venn-lang/assert": "0.1.2",
+    "@venn-lang/contracts": "0.1.2",
+    "@venn-lang/core": "0.1.2",
+    "@venn-lang/dts": "0.1.2",
+    "@venn-lang/http": "0.1.2",
+    "@venn-lang/io": "0.1.2",
+    "@venn-lang/project": "0.1.2",
+    "@venn-lang/runtime": "0.1.2",
+    "@venn-lang/sdk": "0.1.2",
+    "@venn-lang/stdlib": "0.1.2",
+    "@venn-lang/types": "0.1.2"
   },
   "devDependencies": {
     "@types/node": "^24",