@chargebee/chargebee-apps-libs - npm Package Compare versions

Comparing version 1.0.0 to 1.0.1

CHANGELOG.md

 # @chargebee/chargebee-apps-libs
 
+## [1.0.1] - 2026-07-24
+
+### Fixed
+
+- Local modules imported via relative paths (e.g., require('./helper')) now execute within the entry handler’s sandbox, allowing them to share the same environment variables and logging configuration.
+
 ## [1.0.0] - 2026-07-09
@@ -4,0 +10,0 @@

dist/sandbox/public-sandbox-wrapper.d.ts

 import { AllowedModule, CBFileSystem, DependencyManager, ExecutionResult, HandlerPayload, ICBLogger, ISandboxWrapper, ManifestValidator, PackageValidator, SandboxEnvironment } from '@chargebee/chargebee-apps-shared';
+import vm from 'vm';
 /**
@@ -16,5 +17,6 @@ * PublicSandboxWrapper provides a secure environment for executing user-provided NodeJS code
      * @param {string} projectPath - Path to the user project
+     * @param {vm.Context} [vmContext] - Shared VM context for relative user modules
      * @returns {Function} Safe require function
      */
-    createSafeRequire(projectPath: string): (moduleName: string) => any;
+    createSafeRequire(projectPath: string, vmContext?: vm.Context): (moduleName: string) => any;
     /**
@@ -21,0 +23,0 @@ * Loads environment variables from .env file in the project directory

dist/sandbox/public-sandbox-wrapper.js

@@ -1,6 +0,6 @@
-"use strict";var __createBinding=this&&this.__createBinding||(Object.create?(function(a,e,r,n){n===void 0&&(n=r);var t=Object.getOwnPropertyDescriptor(e,r);(!t||("get"in t?!e.__esModule:t.writable||t.configurable))&&(t={enumerable:!0,get:function(){return e[r]}}),Object.defineProperty(a,n,t)}):(function(a,e,r,n){n===void 0&&(n=r),a[n]=e[r]})),__setModuleDefault=this&&this.__setModuleDefault||(Object.create?(function(a,e){Object.defineProperty(a,"default",{enumerable:!0,value:e})}):function(a,e){a.default=e}),__importStar=this&&this.__importStar||(function(){var a=function(e){return a=Object.getOwnPropertyNames||function(r){var n=[];for(var t in r)Object.prototype.hasOwnProperty.call(r,t)&&(n[n.length]=t);return n},a(e)};return function(e){if(e&&e.__esModule)return e;var r={};if(e!=null)for(var n=a(e),t=0;t<n.length;t++)n[t]!=="default"&&__createBinding(r,e,n[t]);return __setModuleDefault(r,e),r}})(),__importDefault=this&&this.__importDefault||function(a){return a&&a.__esModule?a:{default:a}};Object.defineProperty(exports,"__esModule",{value:!0}),exports.PublicSandboxWrapper=void 0;const chargebee_apps_shared_1=require("@chargebee/chargebee-apps-shared"),path_1=__importDefault(require("path")),vm_1=__importDefault(require("vm")),dotenv=__importStar(require("dotenv")),cb_public_logger_1=require("../logger/cb-public-logger");class PublicSandboxWrapper{constructor(e,r,n,t,s){this.fileSystem=r,this.packageValidator=n,this.dependencyManager=t,this.allowedModules=e,this.manifestValidator=s}createSafeRequire(e){return this.dependencyManager.createIsolatedRequire(e,this.allowedModules)}loadEnvironmentVariables(e){const r=path_1.default.join(e,".env"),n={};try{const t=dotenv.config({path:r});t.parsed&&(t.parsed.CB_APPS_READ_ONLY_API&&(n.CB_APPS_READ_ONLY_API=t.parsed.CB_APPS_READ_ONLY_API),t.parsed.CB_APPS_READ_WRITE_API&&(n.CB_APPS_READ_WRITE_API=t.parsed.CB_APPS_READ_WRITE_API),t.parsed.CB_APPS_SITE_DOMAIN?n.CB_APPS_SITE_DOMAIN=t.parsed.CB_APPS_SITE_DOMAIN:n.CB_APPS_SITE_DOMAIN="")}catch(t){chargebee_apps_shared_1.__logger.debug(`Failed to load .env file from ${r}: ${t}`)}return n}createSandbox(e,r,n){const t={exports:{}},s=t.exports,o=this.loadEnvironmentVariables(e),i=Object.prototype.hasOwnProperty.call(r,"iparams"),c=Object.freeze(i?{event:r.event,iparams:r.iparams??{}}:{event:r.event});return{console:(0,cb_public_logger_1.createSafeConsole)(n),payload:c,setTimeout,clearTimeout,setImmediate,clearImmediate,module:t,exports:s,require:this.createSafeRequire(e),process:{cwd:()=>process.cwd(),env:o,nextTick:process.nextTick},global:void 0,Buffer:void 0,__dirname:void 0,__filename:void 0}}async execute(e,r,n){try{chargebee_apps_shared_1.__logger.debug(`Executing user code from: ${e}`),this.packageValidator.validateHandlerExists(e),this.packageValidator.validateManifestExists(e);const t=path_1.default.join(e,"manifest.json"),s=this.manifestValidator.validateAndGetManifestFile(t),o=r.event.event_type,i=s.events[o];if(!i)throw new Error(`No handler configured for event type: ${o}`);const c=i.handler,u=path_1.default.join(e,"handler","handler.js"),l=this.fileSystem.readFileSync(u,"utf8"),d={eventId:r.event.id||"unknown",eventType:r.event.event_type||"unknown"};return await chargebee_apps_shared_1.sandboxContext.run(d,async()=>{const f=this.createSandbox(e,r,n),_=vm_1.default.createContext(f),p=`
+"use strict";var __createBinding=this&&this.__createBinding||(Object.create?(function(a,e,r,n){n===void 0&&(n=r);var t=Object.getOwnPropertyDescriptor(e,r);(!t||("get"in t?!e.__esModule:t.writable||t.configurable))&&(t={enumerable:!0,get:function(){return e[r]}}),Object.defineProperty(a,n,t)}):(function(a,e,r,n){n===void 0&&(n=r),a[n]=e[r]})),__setModuleDefault=this&&this.__setModuleDefault||(Object.create?(function(a,e){Object.defineProperty(a,"default",{enumerable:!0,value:e})}):function(a,e){a.default=e}),__importStar=this&&this.__importStar||(function(){var a=function(e){return a=Object.getOwnPropertyNames||function(r){var n=[];for(var t in r)Object.prototype.hasOwnProperty.call(r,t)&&(n[n.length]=t);return n},a(e)};return function(e){if(e&&e.__esModule)return e;var r={};if(e!=null)for(var n=a(e),t=0;t<n.length;t++)n[t]!=="default"&&__createBinding(r,e,n[t]);return __setModuleDefault(r,e),r}})(),__importDefault=this&&this.__importDefault||function(a){return a&&a.__esModule?a:{default:a}};Object.defineProperty(exports,"__esModule",{value:!0}),exports.PublicSandboxWrapper=void 0;const chargebee_apps_shared_1=require("@chargebee/chargebee-apps-shared"),path_1=__importDefault(require("path")),vm_1=__importDefault(require("vm")),dotenv=__importStar(require("dotenv")),cb_public_logger_1=require("../logger/cb-public-logger");class PublicSandboxWrapper{constructor(e,r,n,t,s){this.fileSystem=r,this.packageValidator=n,this.dependencyManager=t,this.allowedModules=e,this.manifestValidator=s}createSafeRequire(e,r){return this.dependencyManager.createIsolatedRequire(e,this.allowedModules,r)}loadEnvironmentVariables(e){const r=path_1.default.join(e,".env"),n={};try{const t=dotenv.config({path:r});t.parsed&&(t.parsed.CB_APPS_READ_ONLY_API&&(n.CB_APPS_READ_ONLY_API=t.parsed.CB_APPS_READ_ONLY_API),t.parsed.CB_APPS_READ_WRITE_API&&(n.CB_APPS_READ_WRITE_API=t.parsed.CB_APPS_READ_WRITE_API),t.parsed.CB_APPS_SITE_DOMAIN?n.CB_APPS_SITE_DOMAIN=t.parsed.CB_APPS_SITE_DOMAIN:n.CB_APPS_SITE_DOMAIN="")}catch(t){chargebee_apps_shared_1.__logger.debug(`Failed to load .env file from ${r}: ${t}`)}return n}createSandbox(e,r,n){const t={exports:{}},s=t.exports,o=this.loadEnvironmentVariables(e),i=Object.prototype.hasOwnProperty.call(r,"iparams"),c=Object.freeze(i?{event:r.event,iparams:r.iparams??{}}:{event:r.event});return{console:(0,cb_public_logger_1.createSafeConsole)(n),payload:c,setTimeout,clearTimeout,setImmediate,clearImmediate,module:t,exports:s,require:this.createSafeRequire(e),process:{cwd:()=>process.cwd(),env:o,nextTick:process.nextTick},global:void 0,Buffer:void 0,__dirname:void 0,__filename:void 0}}async execute(e,r,n){try{chargebee_apps_shared_1.__logger.debug(`Executing user code from: ${e}`),this.packageValidator.validateHandlerExists(e),this.packageValidator.validateManifestExists(e);const t=path_1.default.join(e,"manifest.json"),s=this.manifestValidator.validateAndGetManifestFile(t),o=r.event.event_type,i=s.events[o];if(!i)throw new Error(`No handler configured for event type: ${o}`);const c=i.handler,d=path_1.default.join(e,"handler","handler.js"),f=this.fileSystem.readFileSync(d,"utf8"),_={eventId:r.event.id||"unknown",eventType:r.event.event_type||"unknown"};return await chargebee_apps_shared_1.sandboxContext.run(_,async()=>{const u=this.createSandbox(e,r,n),l=vm_1.default.createContext(u);u.require=this.createSafeRequire(e,l);const p=`
 					(async function() {
 						"use strict";
 						try {
-							${l}
+							${f}
 							const handler = module.exports["${c}"];
@@ -16,2 +16,2 @@ if (typeof handler !== 'function') {
 					})()
-				`;return await vm_1.default.runInContext(p,_,{timeout:15e3,displayErrors:!0}),{success:!0,statusCode:200}})}catch(t){const s=t;return{success:!1,error:`${s.message}`,stack:s.stack||void 0}}}}exports.PublicSandboxWrapper=PublicSandboxWrapper;
+				`;return await vm_1.default.runInContext(p,l,{timeout:15e3,displayErrors:!0}),{success:!0,statusCode:200}})}catch(t){const s=t;return{success:!1,error:`${s.message}`,stack:s.stack||void 0}}}}exports.PublicSandboxWrapper=PublicSandboxWrapper;

package.json

 {
   "name": "@chargebee/chargebee-apps-libs",
-  "version": "1.0.0",
+  "version": "1.0.1",
   "description": "Public library implementations for Chargebee Apps CLI",
@@ -26,3 +26,3 @@ "main": "dist/index.js",
   "dependencies": {
-    "@chargebee/chargebee-apps-shared": "1.0.0",
+    "@chargebee/chargebee-apps-shared": "1.0.1",
     "dotenv": "^16.3.1"
@@ -29,0 +29,0 @@ },

New alerts

Debug access

Supply chain risk

Uses debug, reflection and dynamic code execution features.

Improved metrics

Total package byte prevSize

177266

0.24%

Lines of code

3268

0.09%

Worsened metrics

Number of low supply chain risk alerts

4

33.33%

Dependency changes

• + Added

  @chargebee/chargebee-apps-shared@1.0.1
  (transitive)

• - Removed

  @chargebee/chargebee-apps-shared@1.0.0
  (transitive)

• Updated

  @chargebee/chargebee-apps-shared@1.0.1