fix: Forward-port Nuxt proxy coercion lock from #1420 - #1429
Merged
Conversation
Document that the security proxy serves the coerced validation target, and add regression tests for process.env / __NUXT__ number|boolean reads. Co-authored-by: Yam Borodetsky <hi@yam.codes>
🦋 Changeset detectedLatest commit: 4028851 The changes in this PR will be included in the next version bump. This PR includes changesets to release 1 package
Not sure what this means? Click here to learn what changesets are. Click here if you're a maintainer who wants to add another changeset to this PR |
github-actions
Bot
added
docs
arkenv
@arkenv/build
@arkenv/bun-plugin
@arkenv/core
@arkenv/fumadocs-ui
@arkenv/nextjs
@arkenv/nuxt
@arkenv/standard
@arkenv/vite-plugin
commit: |
yamcodes
marked this pull request as ready for review
July 20, 2026 20:23
![pullfrog[bot]](https://avatars.githubusercontent.com/in/1768019?s=60&v=4){kind=small}
Contributor
There was a problem hiding this comment.
Important
One stale ADR reference in the new comments points to the wrong architectural record on v1. Details inline.
Reviewed changes — Forward-port of the Nuxt proxy coercion-lock from #1420 to v1: adds a patch changeset for @arkenv/nuxt, documents in arkenv-internal.ts that the security proxy must serve the coerced validation target, and adds regression tests for server and client coercion paths.
- Add changeset describing the coercion-through-proxy guarantee for
@arkenv/nuxt. - Document the proxy contract in
arkenv-internal.tswith inline comments and JSDoc parameters forcreateSecurityProxy. - Add regression tests asserting that
number/booleanvalues stay coerced when sourced fromprocess.env(server) and__NUXT__.config.public(client).
Kimi K2 (free via Pullfrog for OSS) ｜ 𝕏
On v1, ADR 0015 is nextjs-conditional-exports-boundary, not the env-object-canonical-surface decision from dev. Co-authored-by: Yam Borodetsky <hi@yam.codes>
yamcodes
pushed a commit
that referenced
this pull request
Jul 20, 2026
This PR was opened by the [Changesets release](https://github.com/changesets/action) GitHub action. When you're ready to do a release, you can merge this and the packages will be published to npm automatically. If you're not ready to do a release yet, that's fine, whenever you add more changesets to v1, this PR will be updated.⚠️ ⚠️ ⚠️ ⚠️ ⚠️ ⚠️ `v1` is currently in **pre mode** so this branch has prereleases rather than normal releases. If you want to exit prereleases, run `changeset pre exit` on `v1`.⚠️ ⚠️ ⚠️ ⚠️ ⚠️ ⚠️ # Releases ## arkenv@1.0.0-alpha.9 ### Minor Changes - #### Add `add host` command to CLI for adding hosting presets to existing schemas _[`#1419`](#1419) [`0a559ce`](0a559ce) [@yamcodes](https://github.com/yamcodes)_ Support adding a hosting provider preset (Vercel or Netlify) to an existing `env.ts` configuration file: ```bash npx arkenv@alpha add host [provider] ``` - Prompts interactively to select Vercel or Netlify if the provider is omitted. - Auto-detects the framework (Next.js, Nuxt, Vite, Bun) and the validator engine (Zod, Valibot, or ArkType) to inject the preset fields with the correct syntax. - Fallback to logging the generated variable schemas to stdout with manual configuration instructions if `env.ts` is missing or unparseable. ## @arkenv/nuxt@1.0.0-alpha.9 ### Patch Changes - #### Keep coerced number and boolean env values through the security proxy _[`#1429`](#1429) [`6be63f7`](6be63f7) [@yamcodes](https://github.com/yamcodes)_ Lock the Nuxt security proxy so schema-key reads return the coerced validation target. A key declared as `"number"` or `"boolean"` returns a number or boolean at runtime, not a raw string from Nuxt runtime config / `__NUXT__`. ```ts import { arkenv } from "@arkenv/nuxt"; export const env = arkenv({ NUXT_PUBLIC_PORT: "number", PORT: "number", }); // 3000 (number), not "3000" (string) env.NUXT_PUBLIC_PORT; env.PORT; ``` Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
devontov1v1,createSecurityProxyinarkenv-internal.tsalready preferred the coerced validation target (the get-timeruntimeConfig/process.env/__NUXT__preference bug never landed here). This port locks that invariant with ADR 0015 docs comments and coercion regression tests.patchchangeset for@arkenv/nuxt(v1+ bump rules)Notes
useRuntimeConfigcreate-time tests from fix: security proxy prefers raw runtimeConfig/process.env strings over coerced values #1420:v1arkenvInternaldoes not mergeuseRuntimeConfig()intosourceEnv(server usesprocess.env; client uses__NUXT__/process.env).NUXT_PUBLIC_*payload honesty / validator-free client remain (v1) feat(nuxt): boot-time coercion into runtime payload + validator-free client env #1424.Test plan
pnpm --filter @arkenv/nuxt exec vitest run src/index.test.ts(7 passed)pnpm --filter @arkenv/nuxt typecheck