@lukoweb/apitogo 0.1.62 → 0.1.64

package/dist/cli/cli.js

@@ -187,26 +187,58 @@ function parseEnvValue(raw) {
   }
   return trimmed;
 }
+function screamingSnakeToCamel(segment) {
+  return segment.toLowerCase().split("_").filter(Boolean).map(
+    (part, index) => index === 0 ? part : `${part.charAt(0).toUpperCase()}${part.slice(1)}`
+  ).join("");
+}
+function normalizeEnvPathSegment(segment) {
+  if (!segment) {
+    return segment;
+  }
+  const isAllUpper = segment === segment.toUpperCase() && /[A-Z]/.test(segment);
+  if (!isAllUpper) {
+    return segment;
+  }
+  if (segment.includes("_")) {
+    return screamingSnakeToCamel(segment);
+  }
+  return COLLAPSED_UPPERCASE_ALIASES[segment] ?? segment.toLowerCase();
+}
+function resolveExistingKey(target, key) {
+  if (Object.prototype.hasOwnProperty.call(target, key)) {
+    return key;
+  }
+  const lower = key.toLowerCase();
+  for (const existing of Object.keys(target)) {
+    if (existing.toLowerCase() === lower) {
+      return existing;
+    }
+  }
+  return key;
+}
 function setNestedValue(target, pathParts, value) {
   if (pathParts.length === 0) {
     return;
   }
   let current = target;
   for (let index = 0; index < pathParts.length - 1; index += 1) {
-    const key = pathParts[index];
-    if (!key) {
+    const rawKey = pathParts[index];
+    if (!rawKey) {
       return;
     }
+    const key = resolveExistingKey(current, rawKey);
     const next = current[key];
     if (next === void 0 || next === null || typeof next !== "object" || Array.isArray(next)) {
       current[key] = {};
     }
     current = current[key];
   }
-  const leafKey = pathParts[pathParts.length - 1];
-  if (!leafKey) {
+  const rawLeaf = pathParts[pathParts.length - 1];
+  if (!rawLeaf) {
     return;
   }
+  const leafKey = resolveExistingKey(current, rawLeaf);
   current[leafKey] = value;
 }
 function stripRuntimeConfigFields(config2) {
@@ -219,7 +251,7 @@ function applyEnvOverrides(config2, env = process.env) {
     if (!key.startsWith(ENV_PREFIX) || value === void 0) {
       continue;
     }
-    const pathParts = key.slice(ENV_PREFIX.length).split("__").filter(Boolean);
+    const pathParts = key.slice(ENV_PREFIX.length).split("__").filter(Boolean).map(normalizeEnvPathSegment);
     if (pathParts.length === 0) {
       continue;
     }
@@ -550,7 +582,7 @@ function extractSiteConfig(config2) {
   }
   return siteConfig;
 }
-var APITOGO_CONFIG_FILENAME, ENV_PREFIX, DERIVED_MANIFEST_KEYS, SITE_CONFIG_KEYS;
+var APITOGO_CONFIG_FILENAME, ENV_PREFIX, DERIVED_MANIFEST_KEYS, SITE_CONFIG_KEYS, COLLAPSED_UPPERCASE_ALIASES;
 var init_apitogo_config_core = __esm({
   "src/config/apitogo-config-core.ts"() {
     APITOGO_CONFIG_FILENAME = "apitogo.config.json";
@@ -583,6 +615,28 @@ var init_apitogo_config_core = __esm({
       "versions",
       "options"
     ];
+    COLLAPSED_UPPERCASE_ALIASES = {
+      SECRETKEY: "secretKey",
+      WEBHOOKSECRET: "webhookSecret",
+      APIBASEURL: "apiBaseUrl",
+      CLIENTID: "clientId",
+      CLIENTSECRET: "clientSecret",
+      CONNECTIONSTRING: "connectionString",
+      DEMOMODE: "demoMode",
+      DISPLAYNAME: "displayName",
+      PRICEAMOUNT: "priceAmount",
+      PRICECURRENCY: "priceCurrency",
+      BILLINGPERIOD: "billingPeriod",
+      LIMITSJSON: "limitsJson",
+      INCLUDEDACTIONKEYS: "includedActionKeys",
+      SOURCEDIRECTORY: "sourceDirectory",
+      PUBLISHDIRECTORY: "publishDirectory",
+      OPENAPIPATH: "openApiPath",
+      RUNTIMEVERSION: "runtimeVersion",
+      PROJECTID: "projectId",
+      SITENAME: "siteName",
+      LOGOURL: "logoUrl"
+    };
   }
 });
 
@@ -852,7 +906,10 @@ var init_ModulesSchema = __esm({
       sku: z3.string(),
       displayName: z3.string(),
       priceAmount: z3.number().default(0),
-      priceCurrency: z3.string().optional(),
+      priceCurrency: z3.string().trim().toLowerCase().regex(
+        /^[a-z]{3}$/,
+        "priceCurrency must be a 3-letter ISO 4217 code (lowercase)"
+      ).optional(),
       billingPeriod: z3.string().optional(),
       limitsJson: z3.string().optional(),
       includedActionKeys: z3.array(z3.string()).optional()
@@ -993,17 +1050,33 @@ async function readEffectiveManifest(rootDir, _env) {
     return null;
   }
 }
-var BillingPeriodSchema, ManifestPlanInputSchema, DevPortalLocalManifestSchema;
+var BillingPeriodSchema, PriceCurrencySchema, ALLOWED_RUNTIME_VERSIONS, ManifestPlanInputSchema, DevPortalLocalManifestSchema;
 var init_local_manifest = __esm({
   "src/config/local-manifest.ts"() {
     init_apitogo_config_loader();
     init_landing_manifest();
     BillingPeriodSchema = z4.enum(["month", "year", "monthly", "annual"]);
+    PriceCurrencySchema = z4.string().trim().toLowerCase().regex(
+      /^[a-z]{3}$/,
+      "priceCurrency must be a 3-letter ISO 4217 code (lowercase)"
+    );
+    ALLOWED_RUNTIME_VERSIONS = [
+      "DOTNET_10",
+      "DOTNET_9",
+      "DOTNET_8",
+      "NODE_24_LTS",
+      "NODE_22_LTS",
+      "PYTHON_314",
+      "PYTHON_313",
+      "PYTHON_312",
+      "PYTHON_311",
+      "PYTHON_310"
+    ];
     ManifestPlanInputSchema = z4.object({
       sku: z4.string().min(1),
       displayName: z4.string().min(1),
       priceAmount: z4.number().default(0),
-      priceCurrency: z4.string().optional(),
+      priceCurrency: PriceCurrencySchema.optional(),
       billingPeriod: BillingPeriodSchema.optional(),
       limitsJson: z4.string().optional(),
       includedActionKeys: z4.array(z4.string()).optional()
@@ -1042,8 +1115,17 @@ var init_local_manifest = __esm({
         sourceDirectory: z4.string().optional(),
         publishDirectory: z4.string().optional(),
         openApiPath: z4.string().optional(),
-        runtime: z4.string().optional(),
-        runtimeVersion: z4.string().optional(),
+        runtime: z4.enum(["dotnet", "nodejs", "python"]).or(z4.string()).optional(),
+        runtimeVersion: z4.string().optional().refine(
+          (value) => value === void 0 || ALLOWED_RUNTIME_VERSIONS.includes(
+            value.toUpperCase()
+          ) || /^(8(\.0)?|9(\.0)?|10(\.0)?|net8\.0|net9\.0|net10\.0|24|22|3\.(10|11|12|13|14))$/i.test(
+            value
+          ),
+          {
+            message: `runtimeVersion must be a platform slug (${ALLOWED_RUNTIME_VERSIONS.join(", ")}) or a known alias such as 8.0`
+          }
+        ),
         deployed: z4.boolean().optional()
       }).optional(),
       gateway: z4.object({
@@ -4772,6 +4854,18 @@ import {
   runnerImport,
   loadEnv as viteLoadEnv
 } from "vite";
+function mergeJsonConfigWithRuntimeOverrides(fileConfig, importedConfig) {
+  const jsonConfig = buildApitogoConfig({
+    ...fileConfig,
+    plugins: importedConfig.plugins
+  });
+  return {
+    ...jsonConfig,
+    // Custom pages carry React elements and therefore only exist in the
+    // imported TSX config. They cannot be read from or cloned through JSON.
+    navigation: importedConfig.navigation ?? jsonConfig.navigation
+  };
+}
 async function getConfigFilePath(rootDir) {
   for (const fileName of zudokuConfigFiles) {
     const filepath = path5.join(rootDir, fileName);
@@ -4806,10 +4900,7 @@ async function loadZudokuConfigWithMeta(rootDir) {
   let config2;
   try {
     const fileConfig = loadApitogoConfig(rootDir);
-    config2 = buildApitogoConfig({
-      ...fileConfig,
-      plugins: importedConfig.plugins
-    });
+    config2 = mergeJsonConfigWithRuntimeOverrides(fileConfig, importedConfig);
   } catch {
     config2 = importedConfig;
   }
@@ -4906,6 +4997,7 @@ async function loadZudokuConfig(configEnv, rootDir) {
     return { config, envPrefix, publicEnv };
   }
   ({ publicEnv, envPrefix } = loadEnv(configEnv, rootDir));
+  let loadSucceeded = false;
   try {
     const loadedConfig = await loadZudokuConfigWithMeta(rootDir);
     const manifestEnv = resolveManifestEnv(configEnv.mode);
@@ -4943,6 +5035,7 @@ async function loadZudokuConfig(configEnv, rootDir) {
         { timestamp: true }
       );
     }
+    loadSucceeded = true;
     return { config, envPrefix, publicEnv };
   } catch (error) {
     const errorMessage = error instanceof Error ? error.message : String(error);
@@ -4951,7 +5044,11 @@ async function loadZudokuConfig(configEnv, rootDir) {
     }
     throw new Error(errorMessage, { cause: error });
   } finally {
-    await updateModifiedTimes();
+    if (loadSucceeded) {
+      await updateModifiedTimes();
+    } else {
+      modifiedTimes = void 0;
+    }
   }
 }
 var config, envPrefix, publicEnv, modifiedTimes, zudokuConfigFiles, serverConfigOutputFiles, virtualModuleStubPlugin, getCurrentConfig;
@@ -5238,7 +5335,7 @@ import {
 // package.json
 var package_default = {
   name: "@lukoweb/apitogo",
-  version: "0.1.62",
+  version: "0.1.64",
   type: "module",
   sideEffects: [
     "**/*.css",
@@ -7583,9 +7680,7 @@ var viteConfigReloadPlugin = () => ({
       if (file !== currentConfig.__meta.configPath && file.endsWith(".tsx"))
         return;
       invalidate(server);
-      Object.values(server.environments).forEach((env) => {
-        env.moduleGraph.invalidateAll();
-      });
+      reload(server);
       logger.info(
         colors3.blue(
           `Config ${path13.basename(currentConfig.__meta.configPath)} changed. Reloading...`

package/dist/declarations/config/apitogo-config-core.d.ts

@@ -19,6 +19,7 @@ export type AuthenticationSecrets = {
         webhookSecret?: string;
     };
 };
+export declare function normalizeEnvPathSegment(segment: string): string;
 export declare function applyEnvOverrides(config: ApitogoJsonConfig, env?: NodeJS.ProcessEnv): ApitogoJsonConfig;
 type PlanCatalogItem = Record<string, unknown> & {
     sku?: string;

package/dist/declarations/config/loader.d.ts

@@ -16,6 +16,7 @@ export type ConfigWithMeta = ZudokuConfig & {
     };
     __resolvedModules: ResolvedModulesConfig;
 };
+export declare function mergeJsonConfigWithRuntimeOverrides(fileConfig: Record<string, unknown>, importedConfig: ZudokuConfig): ZudokuConfig;
 export declare function findOutputPathOfServerConfig(output: RollupOutput | RollupOutput[] | RollupWatcher): string;
 export declare const getCurrentConfig: () => ConfigWithMeta;
 export declare const setCurrentConfig: (newConfig: ConfigWithMeta) => void;

package/dist/declarations/config/local-manifest.d.ts

@@ -8,6 +8,7 @@ export declare const APITOGO_MANIFEST_ENV_FILES: {
 };
 export { APITOGO_CONFIG_FILENAME };
 export type ApitogoManifestEnv = keyof typeof APITOGO_MANIFEST_ENV_FILES;
+export declare const ALLOWED_RUNTIME_VERSIONS: readonly ["DOTNET_10", "DOTNET_9", "DOTNET_8", "NODE_24_LTS", "NODE_22_LTS", "PYTHON_314", "PYTHON_313", "PYTHON_312", "PYTHON_311", "PYTHON_310"];
 export declare const ManifestPlanInputSchema: z.ZodObject<{
     sku: z.ZodString;
     displayName: z.ZodString;
@@ -70,7 +71,11 @@ export declare const DevPortalLocalManifestSchema: z.ZodObject<{
         sourceDirectory: z.ZodOptional<z.ZodString>;
         publishDirectory: z.ZodOptional<z.ZodString>;
         openApiPath: z.ZodOptional<z.ZodString>;
-        runtime: z.ZodOptional<z.ZodString>;
+        runtime: z.ZodOptional<z.ZodUnion<[z.ZodEnum<{
+            python: "python";
+            dotnet: "dotnet";
+            nodejs: "nodejs";
+        }>, z.ZodString]>>;
         runtimeVersion: z.ZodOptional<z.ZodString>;
         deployed: z.ZodOptional<z.ZodBoolean>;
     }, z.core.$strip>>;

package/docs/configuration/authentication.md

@@ -45,7 +45,7 @@ VITE_APITOGO_AUTHENTICATION_API_BASE_URL=https://your-dev-portal-api.example.com
 ```
 
 You can also set `authentication.apiBaseUrl` in `apitogo.config.json` or
-`APITOGO_CONFIG_authentication__apiBaseUrl` in `.env`.
+`APITOGO_CONFIG_AUTHENTICATION__API_BASE_URL` in `.env`.
 
 **Local demo mode:** In development (`npm run dev`), `demoMode` is enabled by default when the user
 panel is on. You do not need `VITE_APITOGO_AUTHENTICATION_API_BASE_URL`, OIDC, or a running
@@ -55,7 +55,7 @@ dev-portal backend to explore protected account pages locally. Sign in at `/logi
 demo@apitogo.local / password
 ```
 
-Disable with `APITOGO_CONFIG_demoMode=false` in `.env` or `"demoMode": false` in
+Disable with `APITOGO_CONFIG_DEMO_MODE=false` in `.env` or `"demoMode": false` in
 `apitogo.config.json`. Demo mode is never active in production builds.
 
 **Local preview (demo off):** When the backend URL is a placeholder or unreachable and demo mode is
@@ -70,7 +70,7 @@ without restarting the dev server.
 | -------------------------------------------------------- | -------------------------------------------------------------------------- |
 | Site, plans, modules, branding, backend/gateway metadata | `apitogo.config.json` (+ `.env` overrides — see [Manifest](./manifest.md)) |
 | Plugins and custom code                                  | `apitogo.config.tsx`                                                       |
-| OIDC and Stripe for publish                              | `.env.local` via `APITOGO_CONFIG_authentication__*`                        |
+| OIDC and Stripe for publish                              | `.env.local` via `APITOGO_CONFIG_AUTHENTICATION__*`                        |
 
 **Production:** Register one OIDC app with redirect URI `https://{backend}/signin-oidc` (see MCP
 `manualSteps.oidcRedirectUri`). The frontend uses cookie sessions via `credentials: "include"` on

package/docs/configuration/manifest.md

@@ -70,23 +70,23 @@ Public client URL (mirrors `authentication.apiBaseUrl`):
 VITE_APITOGO_AUTHENTICATION_API_BASE_URL=https://your-dev-portal-api.example.com
 ```
 
-Nested config overrides:
+Nested config overrides (uppercase SCREAMING_SNAKE path segments; camelCase still accepted):
 
 ```sh
-APITOGO_CONFIG_site__title=My Local Site
-APITOGO_CONFIG_pricing__enabled=true
-APITOGO_CONFIG_projectId=your-local-project-id
-APITOGO_CONFIG_authentication__apiBaseUrl=https://your-dev-portal-api.example.com
+APITOGO_CONFIG_SITE__TITLE=My Local Site
+APITOGO_CONFIG_PRICING__ENABLED=true
+APITOGO_CONFIG_PROJECT_ID=your-local-project-id
+APITOGO_CONFIG_AUTHENTICATION__API_BASE_URL=https://your-dev-portal-api.example.com
 ```
 
 Publish secrets (`.env.local`, never commit):
 
 ```sh
-APITOGO_CONFIG_authentication__oidc__authority=https://login.example.com
-APITOGO_CONFIG_authentication__oidc__clientId=your-client-id
-APITOGO_CONFIG_authentication__oidc__clientSecret=your-client-secret
-APITOGO_CONFIG_authentication__stripe__secretKey=sk_test_...
-APITOGO_CONFIG_authentication__stripe__webhookSecret=whsec_...
+APITOGO_CONFIG_AUTHENTICATION__OIDC__AUTHORITY=https://login.example.com
+APITOGO_CONFIG_AUTHENTICATION__OIDC__CLIENT_ID=your-client-id
+APITOGO_CONFIG_AUTHENTICATION__OIDC__CLIENT_SECRET=your-client-secret
+APITOGO_CONFIG_AUTHENTICATION__STRIPE__SECRET_KEY=sk_test_...
+APITOGO_CONFIG_AUTHENTICATION__STRIPE__WEBHOOK_SECRET=whsec_...
 ```
 
 ## Thin `apitogo.config.tsx`

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@lukoweb/apitogo",
-  "version": "0.1.62",
+  "version": "0.1.64",
   "type": "module",
   "sideEffects": [
     "**/*.css",

package/src/config/apitogo-config-core.ts

@@ -47,7 +47,7 @@ export type AuthenticationSecrets = {
   email?: {
     connectionString?: string;
   };
-  /** Provider secrets keyed by provider `id` (from env: `authentication__providers__{id}__clientSecret`). */
+  /** Provider secrets keyed by provider `id` (from env: `AUTHENTICATION__PROVIDERS__{id}__CLIENT_SECRET`). */
   providers?: Record<string, { clientSecret?: string }>;
   stripe?: {
     secretKey?: string;
@@ -89,6 +89,82 @@ function parseEnvValue(raw: string | undefined): unknown {
   return trimmed;
 }
 
+/** Collapsed ALLCAPS aliases for multi-word camelCase config keys. */
+const COLLAPSED_UPPERCASE_ALIASES: Record<string, string> = {
+  SECRETKEY: "secretKey",
+  WEBHOOKSECRET: "webhookSecret",
+  APIBASEURL: "apiBaseUrl",
+  CLIENTID: "clientId",
+  CLIENTSECRET: "clientSecret",
+  CONNECTIONSTRING: "connectionString",
+  DEMOMODE: "demoMode",
+  DISPLAYNAME: "displayName",
+  PRICEAMOUNT: "priceAmount",
+  PRICECURRENCY: "priceCurrency",
+  BILLINGPERIOD: "billingPeriod",
+  LIMITSJSON: "limitsJson",
+  INCLUDEDACTIONKEYS: "includedActionKeys",
+  SOURCEDIRECTORY: "sourceDirectory",
+  PUBLISHDIRECTORY: "publishDirectory",
+  OPENAPIPATH: "openApiPath",
+  RUNTIMEVERSION: "runtimeVersion",
+  PROJECTID: "projectId",
+  SITENAME: "siteName",
+  LOGOURL: "logoUrl",
+};
+
+function screamingSnakeToCamel(segment: string): string {
+  return segment
+    .toLowerCase()
+    .split("_")
+    .filter(Boolean)
+    .map((part, index) =>
+      index === 0 ? part : `${part.charAt(0).toUpperCase()}${part.slice(1)}`,
+    )
+    .join("");
+}
+
+/**
+ * Normalize one `APITOGO_CONFIG_*` path segment to the JSON key casing.
+ * - Mixed/camelCase → leave as-is (legacy)
+ * - `SECRET_KEY` → `secretKey`
+ * - `AUTHENTICATION` → `authentication`
+ * - `SECRETKEY` → `secretKey` (collapsed alias)
+ */
+export function normalizeEnvPathSegment(segment: string): string {
+  if (!segment) {
+    return segment;
+  }
+
+  const isAllUpper =
+    segment === segment.toUpperCase() && /[A-Z]/.test(segment);
+  if (!isAllUpper) {
+    return segment;
+  }
+
+  if (segment.includes("_")) {
+    return screamingSnakeToCamel(segment);
+  }
+
+  return COLLAPSED_UPPERCASE_ALIASES[segment] ?? segment.toLowerCase();
+}
+
+function resolveExistingKey(
+  target: Record<string, unknown>,
+  key: string,
+): string {
+  if (Object.prototype.hasOwnProperty.call(target, key)) {
+    return key;
+  }
+  const lower = key.toLowerCase();
+  for (const existing of Object.keys(target)) {
+    if (existing.toLowerCase() === lower) {
+      return existing;
+    }
+  }
+  return key;
+}
+
 function setNestedValue(
   target: Record<string, unknown>,
   pathParts: string[],
@@ -100,10 +176,11 @@ function setNestedValue(
 
   let current: Record<string, unknown> = target;
   for (let index = 0; index < pathParts.length - 1; index += 1) {
-    const key = pathParts[index];
-    if (!key) {
+    const rawKey = pathParts[index];
+    if (!rawKey) {
       return;
     }
+    const key = resolveExistingKey(current, rawKey);
     const next = current[key];
     if (
       next === undefined ||
@@ -116,11 +193,12 @@ function setNestedValue(
     current = current[key] as Record<string, unknown>;
   }
 
-  const leafKey = pathParts[pathParts.length - 1];
-  if (!leafKey) {
+  const rawLeaf = pathParts[pathParts.length - 1];
+  if (!rawLeaf) {
     return;
   }
 
+  const leafKey = resolveExistingKey(current, rawLeaf);
   current[leafKey] = value;
 }
 
@@ -144,7 +222,11 @@ export function applyEnvOverrides(
       continue;
     }
 
-    const pathParts = key.slice(ENV_PREFIX.length).split("__").filter(Boolean);
+    const pathParts = key
+      .slice(ENV_PREFIX.length)
+      .split("__")
+      .filter(Boolean)
+      .map(normalizeEnvPathSegment);
 
     if (pathParts.length === 0) {
       continue;

package/src/config/loader.ts

@@ -69,6 +69,23 @@ const zudokuConfigFiles = [
 
 const serverConfigOutputFiles = ["apitogo.config.js", "zudoku.config.js"];
 
+export function mergeJsonConfigWithRuntimeOverrides(
+  fileConfig: Record<string, unknown>,
+  importedConfig: ZudokuConfig,
+): ZudokuConfig {
+  const jsonConfig = buildApitogoConfig({
+    ...fileConfig,
+    plugins: importedConfig.plugins,
+  });
+
+  return {
+    ...jsonConfig,
+    // Custom pages carry React elements and therefore only exist in the
+    // imported TSX config. They cannot be read from or cloned through JSON.
+    navigation: importedConfig.navigation ?? jsonConfig.navigation,
+  };
+}
+
 async function getConfigFilePath(rootDir: string) {
   for (const fileName of zudokuConfigFiles) {
     const filepath = path.join(rootDir, fileName);
@@ -123,10 +140,7 @@ async function loadZudokuConfigWithMeta(
   let config: ZudokuConfig;
   try {
     const fileConfig = loadApitogoConfig(rootDir);
-    config = buildApitogoConfig({
-      ...fileConfig,
-      plugins: importedConfig.plugins,
-    });
+    config = mergeJsonConfigWithRuntimeOverrides(fileConfig, importedConfig);
   } catch {
     config = importedConfig;
   }
@@ -271,6 +285,7 @@ export async function loadZudokuConfig(
 
   ({ publicEnv, envPrefix } = loadEnv(configEnv, rootDir));
 
+  let loadSucceeded = false;
   try {
     const loadedConfig = await loadZudokuConfigWithMeta(rootDir);
     const manifestEnv = resolveManifestEnv(configEnv.mode);
@@ -313,6 +328,7 @@ export async function loadZudokuConfig(
       );
     }
 
+    loadSucceeded = true;
     return { config, envPrefix, publicEnv };
   } catch (error) {
     const errorMessage = error instanceof Error ? error.message : String(error);
@@ -324,7 +340,13 @@ export async function loadZudokuConfig(
 
     throw new Error(errorMessage, { cause: error });
   } finally {
-    await updateModifiedTimes();
+    if (loadSucceeded) {
+      await updateModifiedTimes();
+    } else {
+      // A watcher may have observed a file while it was being replaced.
+      // Retry on the next request instead of caching the failed file mtimes.
+      modifiedTimes = undefined;
+    }
   }
 }
 

package/src/config/local-manifest.ts

@@ -28,11 +28,33 @@ export type ApitogoManifestEnv = keyof typeof APITOGO_MANIFEST_ENV_FILES;
 
 const BillingPeriodSchema = z.enum(["month", "year", "monthly", "annual"]);
 
+const PriceCurrencySchema = z
+  .string()
+  .trim()
+  .toLowerCase()
+  .regex(
+    /^[a-z]{3}$/,
+    "priceCurrency must be a 3-letter ISO 4217 code (lowercase)",
+  );
+
+export const ALLOWED_RUNTIME_VERSIONS = [
+  "DOTNET_10",
+  "DOTNET_9",
+  "DOTNET_8",
+  "NODE_24_LTS",
+  "NODE_22_LTS",
+  "PYTHON_314",
+  "PYTHON_313",
+  "PYTHON_312",
+  "PYTHON_311",
+  "PYTHON_310",
+] as const;
+
 export const ManifestPlanInputSchema = z.object({
   sku: z.string().min(1),
   displayName: z.string().min(1),
   priceAmount: z.number().default(0),
-  priceCurrency: z.string().optional(),
+  priceCurrency: PriceCurrencySchema.optional(),
   billingPeriod: BillingPeriodSchema.optional(),
   limitsJson: z.string().optional(),
   includedActionKeys: z.array(z.string()).optional(),
@@ -90,8 +112,23 @@ export const DevPortalLocalManifestSchema = z.object({
       sourceDirectory: z.string().optional(),
       publishDirectory: z.string().optional(),
       openApiPath: z.string().optional(),
-      runtime: z.string().optional(),
-      runtimeVersion: z.string().optional(),
+      runtime: z.enum(["dotnet", "nodejs", "python"]).or(z.string()).optional(),
+      runtimeVersion: z
+        .string()
+        .optional()
+        .refine(
+          (value) =>
+            value === undefined ||
+            (ALLOWED_RUNTIME_VERSIONS as readonly string[]).includes(
+              value.toUpperCase(),
+            ) ||
+            /^(8(\.0)?|9(\.0)?|10(\.0)?|net8\.0|net9\.0|net10\.0|24|22|3\.(10|11|12|13|14))$/i.test(
+              value,
+            ),
+          {
+            message: `runtimeVersion must be a platform slug (${ALLOWED_RUNTIME_VERSIONS.join(", ")}) or a known alias such as 8.0`,
+          },
+        ),
       deployed: z.boolean().optional(),
     })
     .optional(),

package/src/config/validators/ModulesSchema.ts

@@ -262,7 +262,15 @@ const PlanCatalogItemSchema = z.object({
   sku: z.string(),
   displayName: z.string(),
   priceAmount: z.number().default(0),
-  priceCurrency: z.string().optional(),
+  priceCurrency: z
+    .string()
+    .trim()
+    .toLowerCase()
+    .regex(
+      /^[a-z]{3}$/,
+      "priceCurrency must be a 3-letter ISO 4217 code (lowercase)",
+    )
+    .optional(),
   billingPeriod: z.string().optional(),
   limitsJson: z.string().optional(),
   includedActionKeys: z.array(z.string()).optional(),

package/src/vite/plugin-config-reload.ts

@@ -34,9 +34,7 @@ export const viteConfigReloadPlugin = (): Plugin => ({
         return;
 
       invalidateNavigation(server);
-      Object.values(server.environments).forEach((env) => {
-        env.moduleGraph.invalidateAll();
-      });
+      reload(server);
 
       logger.info(
         colors.blue(