@chidchanun/bcp 0.2.16 → 0.2.18

package/packages/client/src/config.mjs

@@ -0,0 +1,1132 @@
+// packages/config/src/index.ts
+import fs from "node:fs";
+import path from "node:path";
+import {
+  pathToFileURL
+} from "node:url";
+var CONFIG_FILES = [
+  "bcp.config.ts",
+  "bcp.config.mts",
+  "bcp.config.js",
+  "bcp.config.mjs"
+];
+var defaultBcpConfig = {
+  server: {
+    port: 3e3,
+    hostname: "localhost",
+    bodyLimit: 1024 * 1024
+  },
+  compression: true,
+  build: {
+    minify: true,
+    sourceMaps: false
+  },
+  cache: {
+    response: true
+  },
+  experimental: {
+    partialHydration: true,
+    islands: true
+  },
+  security: {
+    poweredByHeader: false,
+    contentSecurityPolicy: false,
+    frameOptions: "SAMEORIGIN",
+    referrerPolicy: "strict-origin-when-cross-origin",
+    permissionsPolicy: "camera=(), microphone=(), geolocation=()"
+  }
+};
+function defineConfig(config) {
+  return config;
+}
+function getConfigFileNames() {
+  return [
+    ...CONFIG_FILES
+  ];
+}
+async function loadBcpConfig(rootDirectory) {
+  const matches = CONFIG_FILES.map(
+    (fileName) => path.join(
+      rootDirectory,
+      fileName
+    )
+  ).filter(
+    (filePath) => fs.existsSync(
+      filePath
+    )
+  );
+  if (matches.length > 1) {
+    throw new Error(
+      `BCP Framework: multiple config files found: ${matches.map((file2) => path.basename(file2)).join(", ")}. Keep only one bcp.config file.`
+    );
+  }
+  if (matches.length === 0) {
+    return {
+      file: null,
+      config: {}
+    };
+  }
+  const file = matches[0];
+  const url = pathToFileURL(
+    file
+  );
+  url.searchParams.set(
+    "bcp-config",
+    `${Date.now()}-${Math.random()}`
+  );
+  const module = await import(url.href);
+  const config = module.default;
+  if (config === void 0) {
+    throw new Error(
+      `BCP Framework: ${path.basename(file)} must export a default config object.`
+    );
+  }
+  assertConfig(
+    config,
+    path.basename(file)
+  );
+  return {
+    file,
+    config
+  };
+}
+async function resolveBcpConfig(rootDirectory, overrides = {}, environment = process.env) {
+  const loaded = await loadBcpConfig(
+    rootDirectory
+  );
+  const config = loaded.config;
+  const resolved = {
+    server: {
+      port: overrides.port ?? parseEnvironmentPort(
+        environment.BCP_PORT
+      ) ?? config.server?.port ?? defaultBcpConfig.server.port,
+      hostname: overrides.hostname ?? nonEmptyEnvironmentValue(
+        environment.BCP_HOSTNAME
+      ) ?? config.server?.hostname ?? defaultBcpConfig.server.hostname,
+      bodyLimit: parsePositiveInteger(
+        environment.BCP_BODY_LIMIT,
+        "BCP_BODY_LIMIT"
+      ) ?? config.server?.bodyLimit ?? defaultBcpConfig.server.bodyLimit
+    },
+    compression: parseEnvironmentBoolean(
+      environment.BCP_COMPRESSION,
+      "BCP_COMPRESSION"
+    ) ?? config.compression ?? defaultBcpConfig.compression,
+    build: {
+      minify: parseEnvironmentBoolean(
+        environment.BCP_BUILD_MINIFY,
+        "BCP_BUILD_MINIFY"
+      ) ?? config.build?.minify ?? defaultBcpConfig.build.minify,
+      sourceMaps: parseEnvironmentBoolean(
+        environment.BCP_BUILD_SOURCE_MAPS,
+        "BCP_BUILD_SOURCE_MAPS"
+      ) ?? config.build?.sourceMaps ?? defaultBcpConfig.build.sourceMaps
+    },
+    cache: {
+      response: parseEnvironmentBoolean(
+        environment.BCP_RESPONSE_CACHE,
+        "BCP_RESPONSE_CACHE"
+      ) ?? config.cache?.response ?? defaultBcpConfig.cache.response
+    },
+    experimental: {
+      partialHydration: parseEnvironmentBoolean(
+        environment.BCP_EXPERIMENTAL_PARTIAL_HYDRATION,
+        "BCP_EXPERIMENTAL_PARTIAL_HYDRATION"
+      ) ?? config.experimental?.partialHydration ?? defaultBcpConfig.experimental.partialHydration,
+      islands: parseEnvironmentBoolean(
+        environment.BCP_EXPERIMENTAL_ISLANDS,
+        "BCP_EXPERIMENTAL_ISLANDS"
+      ) ?? config.experimental?.islands ?? defaultBcpConfig.experimental.islands
+    },
+    security: {
+      poweredByHeader: parseEnvironmentBoolean(
+        environment.BCP_POWERED_BY_HEADER,
+        "BCP_POWERED_BY_HEADER"
+      ) ?? config.security?.poweredByHeader ?? defaultBcpConfig.security.poweredByHeader,
+      contentSecurityPolicy: parseOptionalHeaderEnvironment(
+        environment.BCP_SECURITY_CSP,
+        "BCP_SECURITY_CSP"
+      ) ?? config.security?.contentSecurityPolicy ?? defaultBcpConfig.security.contentSecurityPolicy,
+      frameOptions: parseFrameOptionsEnvironment(
+        environment.BCP_SECURITY_FRAME_OPTIONS
+      ) ?? config.security?.frameOptions ?? defaultBcpConfig.security.frameOptions,
+      referrerPolicy: nonEmptyEnvironmentValue(
+        environment.BCP_SECURITY_REFERRER_POLICY
+      ) ?? config.security?.referrerPolicy ?? defaultBcpConfig.security.referrerPolicy,
+      permissionsPolicy: parseOptionalHeaderEnvironment(
+        environment.BCP_SECURITY_PERMISSIONS_POLICY,
+        "BCP_SECURITY_PERMISSIONS_POLICY"
+      ) ?? config.security?.permissionsPolicy ?? defaultBcpConfig.security.permissionsPolicy
+    }
+  };
+  validateResolvedConfig(
+    resolved
+  );
+  return {
+    file: loaded.file,
+    config: resolved
+  };
+}
+function applyResolvedBcpConfig(config) {
+  process.env.BCP_RESOLVED_CONFIG = JSON.stringify(
+    config
+  );
+  process.env.BCP_COMPRESSION = config.compression ? "1" : "0";
+  process.env.BCP_BODY_LIMIT = String(
+    config.server.bodyLimit
+  );
+  process.env.BCP_BUILD_MINIFY = config.build.minify ? "1" : "0";
+  process.env.BCP_BUILD_SOURCE_MAPS = config.build.sourceMaps ? "1" : "0";
+  process.env.BCP_RESPONSE_CACHE = config.cache.response ? "1" : "0";
+  process.env.BCP_EXPERIMENTAL_PARTIAL_HYDRATION = config.experimental.partialHydration ? "1" : "0";
+  process.env.BCP_EXPERIMENTAL_ISLANDS = config.experimental.islands ? "1" : "0";
+  process.env.BCP_POWERED_BY_HEADER = config.security.poweredByHeader ? "1" : "0";
+  process.env.BCP_SECURITY_CSP = config.security.contentSecurityPolicy === false ? "0" : config.security.contentSecurityPolicy;
+  process.env.BCP_SECURITY_FRAME_OPTIONS = config.security.frameOptions === false ? "0" : config.security.frameOptions;
+  process.env.BCP_SECURITY_REFERRER_POLICY = config.security.referrerPolicy;
+  process.env.BCP_SECURITY_PERMISSIONS_POLICY = config.security.permissionsPolicy === false ? "0" : config.security.permissionsPolicy;
+}
+function readResolvedBcpConfig() {
+  const serialized = process.env.BCP_RESOLVED_CONFIG;
+  if (!serialized) {
+    return structuredClone(
+      defaultBcpConfig
+    );
+  }
+  try {
+    const value = JSON.parse(
+      serialized
+    );
+    validateResolvedConfig(
+      value
+    );
+    return value;
+  } catch (error) {
+    throw new Error(
+      `BCP Framework: invalid resolved configuration state. ${error instanceof Error ? error.message : String(error)}`
+    );
+  }
+}
+function assertConfig(value, label) {
+  if (!isPlainObject(
+    value
+  )) {
+    throw new Error(
+      `BCP Framework: ${label} must export an object.`
+    );
+  }
+  const allowed = /* @__PURE__ */ new Set([
+    "server",
+    "compression",
+    "build",
+    "cache",
+    "experimental",
+    "security"
+  ]);
+  for (const key of Object.keys(
+    value
+  )) {
+    if (!allowed.has(
+      key
+    )) {
+      throw new Error(
+        `BCP Framework: unknown config option "${key}" in ${label}.`
+      );
+    }
+  }
+  if (value.server !== void 0) {
+    assertObjectKeys(
+      value.server,
+      "server",
+      [
+        "port",
+        "hostname",
+        "bodyLimit"
+      ]
+    );
+    if (value.server.port !== void 0) {
+      assertPort(
+        value.server.port,
+        "server.port"
+      );
+    }
+    if (value.server.hostname !== void 0 && (typeof value.server.hostname !== "string" || value.server.hostname.trim() === "")) {
+      throw new Error(
+        "BCP Framework: server.hostname must be a non-empty string."
+      );
+    }
+    if (value.server.bodyLimit !== void 0) {
+      assertPositiveInteger(
+        value.server.bodyLimit,
+        "server.bodyLimit"
+      );
+    }
+  }
+  assertOptionalBoolean(
+    value.compression,
+    "compression"
+  );
+  if (value.build !== void 0) {
+    assertObjectKeys(
+      value.build,
+      "build",
+      [
+        "minify",
+        "sourceMaps"
+      ]
+    );
+    assertOptionalBoolean(
+      value.build.minify,
+      "build.minify"
+    );
+    assertOptionalBoolean(
+      value.build.sourceMaps,
+      "build.sourceMaps"
+    );
+  }
+  if (value.cache !== void 0) {
+    assertObjectKeys(
+      value.cache,
+      "cache",
+      [
+        "response"
+      ]
+    );
+    assertOptionalBoolean(
+      value.cache.response,
+      "cache.response"
+    );
+  }
+  if (value.experimental !== void 0) {
+    assertObjectKeys(
+      value.experimental,
+      "experimental",
+      [
+        "partialHydration",
+        "islands"
+      ]
+    );
+    assertOptionalBoolean(
+      value.experimental.partialHydration,
+      "experimental.partialHydration"
+    );
+    assertOptionalBoolean(
+      value.experimental.islands,
+      "experimental.islands"
+    );
+  }
+  if (value.security !== void 0) {
+    assertObjectKeys(
+      value.security,
+      "security",
+      [
+        "poweredByHeader",
+        "contentSecurityPolicy",
+        "frameOptions",
+        "referrerPolicy",
+        "permissionsPolicy"
+      ]
+    );
+    assertOptionalBoolean(
+      value.security.poweredByHeader,
+      "security.poweredByHeader"
+    );
+    assertOptionalHeaderOrFalse(
+      value.security.contentSecurityPolicy,
+      "security.contentSecurityPolicy"
+    );
+    assertFrameOptions(
+      value.security.frameOptions,
+      "security.frameOptions"
+    );
+    assertOptionalHeaderString(
+      value.security.referrerPolicy,
+      "security.referrerPolicy"
+    );
+    assertOptionalHeaderOrFalse(
+      value.security.permissionsPolicy,
+      "security.permissionsPolicy"
+    );
+  }
+}
+function validateResolvedConfig(value) {
+  if (!value || !value.server || !value.build || !value.cache || !value.experimental || !value.security) {
+    throw new Error(
+      "Resolved config is incomplete."
+    );
+  }
+  assertPort(
+    value.server.port,
+    "server.port"
+  );
+  assertPositiveInteger(
+    value.server.bodyLimit,
+    "server.bodyLimit"
+  );
+  if (typeof value.server.hostname !== "string" || value.server.hostname.trim() === "") {
+    throw new Error(
+      "server.hostname must be a non-empty string."
+    );
+  }
+  for (const [
+    label,
+    item
+  ] of [
+    ["compression", value.compression],
+    ["build.minify", value.build.minify],
+    ["build.sourceMaps", value.build.sourceMaps],
+    ["cache.response", value.cache.response],
+    ["experimental.partialHydration", value.experimental.partialHydration],
+    ["experimental.islands", value.experimental.islands],
+    ["security.poweredByHeader", value.security.poweredByHeader]
+  ]) {
+    if (typeof item !== "boolean") {
+      throw new Error(
+        `${label} must be boolean.`
+      );
+    }
+  }
+  assertHeaderOrFalse(
+    value.security.contentSecurityPolicy,
+    "security.contentSecurityPolicy"
+  );
+  assertFrameOptions(
+    value.security.frameOptions,
+    "security.frameOptions"
+  );
+  assertHeaderString(
+    value.security.referrerPolicy,
+    "security.referrerPolicy"
+  );
+  assertHeaderOrFalse(
+    value.security.permissionsPolicy,
+    "security.permissionsPolicy"
+  );
+}
+function assertObjectKeys(value, label, keys) {
+  if (!isPlainObject(
+    value
+  )) {
+    throw new Error(
+      `BCP Framework: ${label} must be an object.`
+    );
+  }
+  const allowed = new Set(
+    keys
+  );
+  for (const key of Object.keys(
+    value
+  )) {
+    if (!allowed.has(
+      key
+    )) {
+      throw new Error(
+        `BCP Framework: unknown config option "${label}.${key}".`
+      );
+    }
+  }
+}
+function assertOptionalBoolean(value, label) {
+  if (value !== void 0 && typeof value !== "boolean") {
+    throw new Error(
+      `BCP Framework: ${label} must be boolean.`
+    );
+  }
+}
+function assertPort(value, label) {
+  if (!Number.isInteger(
+    value
+  ) || Number(value) < 1 || Number(value) > 65535) {
+    throw new Error(
+      `BCP Framework: ${label} must be an integer between 1 and 65535.`
+    );
+  }
+}
+function assertPositiveInteger(value, label) {
+  if (!Number.isInteger(
+    value
+  ) || Number(value) < 1) {
+    throw new Error(
+      `BCP Framework: ${label} must be a positive integer.`
+    );
+  }
+}
+function assertOptionalHeaderOrFalse(value, label) {
+  if (value === void 0) {
+    return;
+  }
+  assertHeaderOrFalse(
+    value,
+    label
+  );
+}
+function assertHeaderOrFalse(value, label) {
+  if (value === false) {
+    return;
+  }
+  assertHeaderString(
+    value,
+    label
+  );
+}
+function assertOptionalHeaderString(value, label) {
+  if (value === void 0) {
+    return;
+  }
+  assertHeaderString(
+    value,
+    label
+  );
+}
+function assertHeaderString(value, label) {
+  if (typeof value !== "string" || value.trim() === "") {
+    throw new Error(
+      `BCP Framework: ${label} must be a non-empty string.`
+    );
+  }
+  if (value.includes("\r") || value.includes("\n") || value.includes("\0")) {
+    throw new Error(
+      `BCP Framework: ${label} must not contain control characters.`
+    );
+  }
+}
+function assertFrameOptions(value, label) {
+  if (value === void 0 || value === false || value === "DENY" || value === "SAMEORIGIN") {
+    return;
+  }
+  throw new Error(
+    `BCP Framework: ${label} must be "DENY", "SAMEORIGIN", or false.`
+  );
+}
+function parseEnvironmentPort(value) {
+  if (value === void 0 || value.trim() === "") {
+    return void 0;
+  }
+  const port = Number(
+    value
+  );
+  assertPort(
+    port,
+    "BCP_PORT"
+  );
+  return port;
+}
+function parsePositiveInteger(value, label) {
+  if (value === void 0 || value.trim() === "") {
+    return void 0;
+  }
+  const parsed = Number(
+    value
+  );
+  assertPositiveInteger(
+    parsed,
+    label
+  );
+  return parsed;
+}
+function parseEnvironmentBoolean(value, label) {
+  if (value === void 0 || value.trim() === "") {
+    return void 0;
+  }
+  const normalized = value.trim().toLowerCase();
+  if (normalized === "1" || normalized === "true" || normalized === "yes" || normalized === "on") {
+    return true;
+  }
+  if (normalized === "0" || normalized === "false" || normalized === "no" || normalized === "off") {
+    return false;
+  }
+  throw new Error(
+    `BCP Framework: ${label} must be a boolean value (true/false, 1/0, yes/no, on/off).`
+  );
+}
+function parseOptionalHeaderEnvironment(value, label) {
+  if (value === void 0 || value.trim() === "") {
+    return void 0;
+  }
+  const normalized = value.trim();
+  const lowered = normalized.toLowerCase();
+  if (lowered === "0" || lowered === "false" || lowered === "off") {
+    return false;
+  }
+  assertHeaderString(
+    normalized,
+    label
+  );
+  return normalized;
+}
+function parseFrameOptionsEnvironment(value) {
+  if (value === void 0 || value.trim() === "") {
+    return void 0;
+  }
+  const normalized = value.trim().toUpperCase();
+  if (normalized === "0" || normalized === "FALSE" || normalized === "OFF") {
+    return false;
+  }
+  if (normalized === "DENY" || normalized === "SAMEORIGIN") {
+    return normalized;
+  }
+  throw new Error(
+    "BCP Framework: BCP_SECURITY_FRAME_OPTIONS must be DENY, SAMEORIGIN, or off."
+  );
+}
+function nonEmptyEnvironmentValue(value) {
+  const normalized = value?.trim();
+  return normalized ? normalized : void 0;
+}
+function isPlainObject(value) {
+  return typeof value === "object" && value !== null && !Array.isArray(
+    value
+  );
+}
+
+// packages/config/src/environment-schema.ts
+function defineEnvironment(schema) {
+  assertEnvironmentSchema(
+    schema
+  );
+  return schema;
+}
+function applyEnvironmentDefaults(schema, target = process.env) {
+  assertEnvironmentSchema(
+    schema
+  );
+  let applied = 0;
+  for (const [
+    key,
+    rule
+  ] of Object.entries(
+    schema
+  )) {
+    if (rule.default === void 0 || target[key] !== void 0 && target[key] !== "") {
+      continue;
+    }
+    target[key] = serializeEnvironmentValue(
+      rule.default
+    );
+    applied++;
+  }
+  return applied;
+}
+function validateEnvironment(schema, source = process.env) {
+  assertEnvironmentSchema(
+    schema
+  );
+  const issues = [];
+  const values = {};
+  let present = 0;
+  let defaults = 0;
+  for (const [
+    key,
+    rule
+  ] of Object.entries(
+    schema
+  )) {
+    if (rule.secret && key.startsWith(
+      "BCP_PUBLIC_"
+    )) {
+      issues.push({
+        key,
+        severity: "error",
+        code: "public_secret",
+        message: `${key} is marked secret but uses the BCP_PUBLIC_ prefix. Public variables are embedded in client bundles.`
+      });
+    }
+    const raw = source[key];
+    const hasSourceValue = raw !== void 0 && raw !== "";
+    if (hasSourceValue) {
+      present++;
+    }
+    const input = hasSourceValue ? raw : rule.default;
+    if (input === void 0) {
+      if (rule.required) {
+        issues.push({
+          key,
+          severity: "error",
+          code: "missing",
+          message: `${key} is required but was not provided.`
+        });
+      }
+      continue;
+    }
+    if (!hasSourceValue) {
+      defaults++;
+    }
+    const parsed = parseEnvironmentRuleValue(
+      key,
+      input,
+      rule,
+      issues
+    );
+    if (parsed !== void 0) {
+      values[key] = parsed;
+    }
+  }
+  return {
+    ok: !issues.some(
+      (issue) => issue.severity === "error"
+    ),
+    checked: Object.keys(
+      schema
+    ).length,
+    present,
+    defaults,
+    issues,
+    values
+  };
+}
+function assertEnvironmentSchema(schema) {
+  if (!isPlainObject2(
+    schema
+  )) {
+    throw new Error(
+      "BCP Framework: environment config must be an object."
+    );
+  }
+  for (const [
+    key,
+    value
+  ] of Object.entries(
+    schema
+  )) {
+    if (!/^[A-Za-z_][A-Za-z0-9_]*$/.test(
+      key
+    )) {
+      throw new Error(
+        `BCP Framework: invalid environment schema key "${key}".`
+      );
+    }
+    assertEnvironmentRule(
+      key,
+      value
+    );
+  }
+}
+function assertEnvironmentRule(key, value) {
+  if (!isPlainObject2(
+    value
+  )) {
+    throw new Error(
+      `BCP Framework: environment.${key} must be an object.`
+    );
+  }
+  const allowed = /* @__PURE__ */ new Set([
+    "type",
+    "required",
+    "secret",
+    "minLength",
+    "maxLength",
+    "min",
+    "max",
+    "default",
+    "description"
+  ]);
+  for (const property of Object.keys(
+    value
+  )) {
+    if (!allowed.has(
+      property
+    )) {
+      throw new Error(
+        `BCP Framework: unknown config option "environment.${key}.${property}".`
+      );
+    }
+  }
+  if (value.type !== "string" && value.type !== "number" && value.type !== "boolean" && value.type !== "url") {
+    throw new Error(
+      `BCP Framework: environment.${key}.type must be string, number, boolean, or url.`
+    );
+  }
+  assertOptionalBoolean2(
+    value.required,
+    `environment.${key}.required`
+  );
+  assertOptionalBoolean2(
+    value.secret,
+    `environment.${key}.secret`
+  );
+  assertOptionalNonNegativeInteger(
+    value.minLength,
+    `environment.${key}.minLength`
+  );
+  assertOptionalNonNegativeInteger(
+    value.maxLength,
+    `environment.${key}.maxLength`
+  );
+  assertOptionalFiniteNumber(
+    value.min,
+    `environment.${key}.min`
+  );
+  assertOptionalFiniteNumber(
+    value.max,
+    `environment.${key}.max`
+  );
+  if (value.description !== void 0 && (typeof value.description !== "string" || value.description.trim() === "")) {
+    throw new Error(
+      `BCP Framework: environment.${key}.description must be a non-empty string.`
+    );
+  }
+  if (value.minLength !== void 0 && value.maxLength !== void 0 && value.minLength > value.maxLength) {
+    throw new Error(
+      `BCP Framework: environment.${key}.minLength cannot be greater than maxLength.`
+    );
+  }
+  if (value.min !== void 0 && value.max !== void 0 && value.min > value.max) {
+    throw new Error(
+      `BCP Framework: environment.${key}.min cannot be greater than max.`
+    );
+  }
+  if (value.default !== void 0) {
+    const issues = [];
+    const parsed = parseEnvironmentRuleValue(
+      key,
+      value.default,
+      value,
+      issues
+    );
+    if (parsed === void 0 || issues.some(
+      (issue) => issue.severity === "error"
+    )) {
+      throw new Error(
+        `BCP Framework: environment.${key}.default does not satisfy its declared rule.`
+      );
+    }
+  }
+}
+function parseEnvironmentRuleValue(key, input, rule, issues) {
+  if (rule.type === "string" || rule.type === "url") {
+    if (typeof input !== "string") {
+      issues.push({
+        key,
+        severity: "error",
+        code: "invalid_type",
+        message: `${key} must be a ${rule.type}.`
+      });
+      return void 0;
+    }
+    if (rule.minLength !== void 0 && input.length < rule.minLength) {
+      issues.push({
+        key,
+        severity: "error",
+        code: "too_short",
+        message: `${key} must contain at least ${rule.minLength} character(s).`
+      });
+    }
+    if (rule.maxLength !== void 0 && input.length > rule.maxLength) {
+      issues.push({
+        key,
+        severity: "error",
+        code: "too_long",
+        message: `${key} must contain at most ${rule.maxLength} character(s).`
+      });
+    }
+    if (rule.type === "url") {
+      try {
+        const url = new URL(
+          input
+        );
+        if (url.protocol !== "http:" && url.protocol !== "https:") {
+          throw new Error(
+            "unsupported protocol"
+          );
+        }
+      } catch {
+        issues.push({
+          key,
+          severity: "error",
+          code: "invalid_type",
+          message: `${key} must be an absolute http(s) URL.`
+        });
+        return void 0;
+      }
+    }
+    return input;
+  }
+  if (rule.type === "number") {
+    const parsed = typeof input === "number" ? input : typeof input === "string" && input.trim() !== "" ? Number(
+      input
+    ) : Number.NaN;
+    if (!Number.isFinite(
+      parsed
+    )) {
+      issues.push({
+        key,
+        severity: "error",
+        code: "invalid_type",
+        message: `${key} must be a finite number.`
+      });
+      return void 0;
+    }
+    if (rule.min !== void 0 && parsed < rule.min) {
+      issues.push({
+        key,
+        severity: "error",
+        code: "too_small",
+        message: `${key} must be greater than or equal to ${rule.min}.`
+      });
+    }
+    if (rule.max !== void 0 && parsed > rule.max) {
+      issues.push({
+        key,
+        severity: "error",
+        code: "too_large",
+        message: `${key} must be less than or equal to ${rule.max}.`
+      });
+    }
+    return parsed;
+  }
+  if (typeof input === "boolean") {
+    return input;
+  }
+  if (typeof input === "string") {
+    const normalized = input.trim().toLowerCase();
+    if ([
+      "1",
+      "true",
+      "yes",
+      "on"
+    ].includes(
+      normalized
+    )) {
+      return true;
+    }
+    if ([
+      "0",
+      "false",
+      "no",
+      "off"
+    ].includes(
+      normalized
+    )) {
+      return false;
+    }
+  }
+  issues.push({
+    key,
+    severity: "error",
+    code: "invalid_type",
+    message: `${key} must be a boolean value (true/false, 1/0, yes/no, on/off).`
+  });
+  return void 0;
+}
+function serializeEnvironmentValue(value) {
+  if (typeof value === "boolean") {
+    return value ? "true" : "false";
+  }
+  return String(
+    value
+  );
+}
+function assertOptionalBoolean2(value, label) {
+  if (value !== void 0 && typeof value !== "boolean") {
+    throw new Error(
+      `BCP Framework: ${label} must be boolean.`
+    );
+  }
+}
+function assertOptionalNonNegativeInteger(value, label) {
+  if (value !== void 0 && (!Number.isInteger(
+    value
+  ) || Number(value) < 0)) {
+    throw new Error(
+      `BCP Framework: ${label} must be a non-negative integer.`
+    );
+  }
+}
+function assertOptionalFiniteNumber(value, label) {
+  if (value !== void 0 && (typeof value !== "number" || !Number.isFinite(
+    value
+  ))) {
+    throw new Error(
+      `BCP Framework: ${label} must be a finite number.`
+    );
+  }
+}
+function isPlainObject2(value) {
+  return typeof value === "object" && value !== null && !Array.isArray(
+    value
+  );
+}
+
+// packages/config/src/environment-loader.ts
+import fs2 from "node:fs";
+import path2 from "node:path";
+import {
+  pathToFileURL as pathToFileURL2
+} from "node:url";
+var ENVIRONMENT_SCHEMA_FILES = [
+  "bcp.environment.ts",
+  "bcp.environment.mts",
+  "bcp.environment.js",
+  "bcp.environment.mjs"
+];
+function getEnvironmentSchemaFileNames() {
+  return [
+    ...ENVIRONMENT_SCHEMA_FILES
+  ];
+}
+async function loadBcpEnvironmentSchema(rootDirectory) {
+  const matches = ENVIRONMENT_SCHEMA_FILES.map(
+    (fileName) => path2.join(
+      rootDirectory,
+      fileName
+    )
+  ).filter(
+    (filePath) => fs2.existsSync(
+      filePath
+    )
+  );
+  if (matches.length > 1) {
+    throw new Error(
+      `BCP Framework: multiple environment schema files found: ${matches.map((file2) => path2.basename(file2)).join(", ")}. Keep only one bcp.environment file.`
+    );
+  }
+  if (matches.length === 0) {
+    return {
+      file: null,
+      schema: {}
+    };
+  }
+  const file = matches[0];
+  const url = pathToFileURL2(
+    file
+  );
+  url.searchParams.set(
+    "bcp-environment",
+    `${Date.now()}-${Math.random()}`
+  );
+  const module = await import(url.href);
+  const schema = module.default;
+  if (schema === void 0) {
+    throw new Error(
+      `BCP Framework: ${path2.basename(file)} must export a default environment schema.`
+    );
+  }
+  assertEnvironmentSchema(
+    schema
+  );
+  return {
+    file,
+    schema
+  };
+}
+
+// packages/config/src/diagnostics.ts
+import path3 from "node:path";
+async function diagnoseBcpConfiguration(options) {
+  const environment = options.environment ?? process.env;
+  const resolved = await resolveBcpConfig(
+    options.rootDirectory,
+    options.overrides ?? {},
+    environment
+  );
+  const loadedSchema = await loadBcpEnvironmentSchema(
+    options.rootDirectory
+  );
+  const environmentValidation = validateEnvironment(
+    loadedSchema.schema,
+    environment
+  );
+  const diagnostics = [];
+  appendEnvironmentDiagnostics(
+    diagnostics,
+    environmentValidation
+  );
+  appendRuntimeDiagnostics(
+    diagnostics,
+    options.mode,
+    resolved.config,
+    environment
+  );
+  return {
+    ok: !diagnostics.some(
+      (diagnostic) => diagnostic.severity === "error"
+    ),
+    mode: options.mode,
+    configFile: resolved.file ? path3.basename(
+      resolved.file
+    ) : null,
+    environmentSchemaFile: loadedSchema.file ? path3.basename(
+      loadedSchema.file
+    ) : null,
+    resolvedConfig: resolved.config,
+    environment: {
+      checked: environmentValidation.checked,
+      present: environmentValidation.present,
+      defaults: environmentValidation.defaults
+    },
+    diagnostics
+  };
+}
+function assertConfigurationDiagnostics(report) {
+  if (report.ok) {
+    return;
+  }
+  const errors = report.diagnostics.filter(
+    (diagnostic) => diagnostic.severity === "error"
+  ).map(
+    (diagnostic) => diagnostic.message
+  );
+  throw new Error(
+    `BCP Configuration Error:
+${errors.map((message) => `- ${message}`).join("\n")}`
+  );
+}
+function appendEnvironmentDiagnostics(diagnostics, validation) {
+  for (const issue of validation.issues) {
+    diagnostics.push({
+      severity: issue.severity,
+      code: `environment.${issue.code}`,
+      message: issue.message
+    });
+  }
+}
+function appendRuntimeDiagnostics(diagnostics, mode, config, environment) {
+  if (mode !== "production") {
+    return;
+  }
+  if (config.build.sourceMaps) {
+    diagnostics.push({
+      severity: "warning",
+      code: "production.source_maps",
+      message: "Production source maps are enabled. Confirm that exposing source information is intentional."
+    });
+  }
+  if (config.security.poweredByHeader) {
+    diagnostics.push({
+      severity: "warning",
+      code: "production.powered_by",
+      message: "security.poweredByHeader is enabled in production."
+    });
+  }
+  if (config.security.contentSecurityPolicy === false) {
+    diagnostics.push({
+      severity: "warning",
+      code: "production.csp_disabled",
+      message: "Content-Security-Policy is disabled. Configure a policy when the application can support one."
+    });
+  }
+  const trustProxy = environment.BCP_TRUST_PROXY?.trim().toLowerCase();
+  if (trustProxy === "true" || trustProxy === "1" || trustProxy === "yes" || trustProxy === "on") {
+    diagnostics.push({
+      severity: "warning",
+      code: "production.trust_proxy",
+      message: "BCP_TRUST_PROXY is enabled. Ensure untrusted clients cannot bypass the trusted reverse proxy/load balancer."
+    });
+  }
+}
+export {
+  applyEnvironmentDefaults,
+  applyResolvedBcpConfig,
+  assertConfigurationDiagnostics,
+  defaultBcpConfig,
+  defineConfig,
+  defineEnvironment,
+  diagnoseBcpConfiguration,
+  getConfigFileNames,
+  getEnvironmentSchemaFileNames,
+  loadBcpConfig,
+  loadBcpEnvironmentSchema,
+  readResolvedBcpConfig,
+  resolveBcpConfig,
+  validateEnvironment
+};