fix: security proxy prefers raw runtimeConfig/process.env strings over coerced values

[yamcodes]

Fixes #1327

Summary

• Prefer the coerced validation target in the Nuxt security proxy instead of re-reading raw useRuntimeConfig() / process.env / __NUXT__.config.public strings (which silently undid ADR 0002 coercion).
• Update dynamic useRuntimeConfig tests to assert coerced number/boolean values, and add regression coverage for the server process.env and client __NUXT__ paths.
• Add a missing @arkenv/nuxt Vitest project config so the package tests run in CI.

Test plan

• pnpm exec vitest run --project @arkenv/nuxt
• pnpm run typecheck
• pnpm run test
• pnpm run fix

Made with Cursor

[changeset-bot]

🦋 Changeset detected

Latest commit: eef5902

The changes in this PR will be included in the next version bump.

This PR includes changesets to release 1 package

Name	Type
@arkenv/nuxt	Patch

Not sure what this means? Click here to learn what changesets are.

Click here if you're a maintainer who wants to add another changeset to this PR

[pkg-pr-new]

Open in StackBlitz

arkenv

npm i https://pkg.pr.new/arkenv@1420

@arkenv/build

npm i https://pkg.pr.new/@arkenv/build@1420

@arkenv/bun-plugin

npm i https://pkg.pr.new/@arkenv/bun-plugin@1420

@arkenv/cli

npm i https://pkg.pr.new/@arkenv/cli@1420

@arkenv/fumadocs-ui

npm i https://pkg.pr.new/@arkenv/fumadocs-ui@1420

@arkenv/nextjs

npm i https://pkg.pr.new/@arkenv/nextjs@1420

@arkenv/nuxt

npm i https://pkg.pr.new/@arkenv/nuxt@1420

@arkenv/vite-plugin

npm i https://pkg.pr.new/@arkenv/vite-plugin@1420

commit: 1a12d37

[arkenv-bot]

📦 Bundle Size Report

No results found

✅ All size limits passed!

[pullfrog]

✅ No new issues found.

Reviewed changes — the PR fixes the Nuxt security proxy so schema-key reads always return the coerced validation target, and adds regression coverage plus the missing Vitest project config.

• packages/nuxt/src/create-env.ts — removes the per-get runtimeConfig/process.env/__NUXT__ preference branches from createSecurityProxy.
• packages/nuxt/src/index.test.ts — updates dynamic config tests to assert coerced number/boolean values and adds tests for the server process.env and client __NUXT__ paths.
• packages/nuxt/src/mock-imports.ts — extracts the useRuntimeConfig test mock so #imports resolves cleanly.
• packages/nuxt/vitest.config.ts — adds the project config required for CI discovery.
• .changeset/fix-nuxt-proxy-coercion.md — patch changeset for @arkenv/nuxt.

I built the required workspace dependencies (@repo/scope, @repo/types, @arkenv/build, arkenv) and verified:

• pnpm exec vitest run --project @arkenv/nuxt — 28 tests passed.
• pnpm --filter @arkenv/nuxt typecheck — clean.

  ^{｜ View workflow run ｜ Using Kimi K2 (free via Pullfrog for OSS) ｜ 𝕏}

[cursor]

Follow-up: renamed the coercion regression tests so they no longer say “dynamically resolve” / “fallback path” (that described the old get-time re-read of raw strings). They now describe create-time sourcing through the proxy.

Suggested PR body note (couldn’t edit the description from this agent):

The previous suite only asserted string keys on the useRuntimeConfig / process.env / __NUXT__ paths, so CI could not catch this bug. Boot-time NUXT_PUBLIC_* override honesty and a validator-free client env remain in #1424 (v1).

[pullfrog]

Important

The latest changeset edits still leave the ts code block unclosed, which will break the changeset/changelog render.

Reviewed changes — The new commits since df2c3a5a only touched .changeset/fix-nuxt-proxy-coercion.md; they tightened the description but did not add the missing closing fence.

• Updated .changeset/fix-nuxt-proxy-coercion.md — clarified that coerced number/boolean values are returned at runtime.
• Merged current dev — brought the branch up to date with no semantic conflicts.

  ^{｜ Fix all ➔ ｜ Fix 👍s ➔ ｜ View workflow run ｜ Using Kimi K2 (free via Pullfrog for OSS) ｜ 𝕏}