@lukoweb/apitogo 0.1.63 → 0.1.65

package/dist/cli/cli.js

@@ -187,26 +187,58 @@ function parseEnvValue(raw) {
   }
   return trimmed;
 }
+function screamingSnakeToCamel(segment) {
+  return segment.toLowerCase().split("_").filter(Boolean).map(
+    (part, index) => index === 0 ? part : `${part.charAt(0).toUpperCase()}${part.slice(1)}`
+  ).join("");
+}
+function normalizeEnvPathSegment(segment) {
+  if (!segment) {
+    return segment;
+  }
+  const isAllUpper = segment === segment.toUpperCase() && /[A-Z]/.test(segment);
+  if (!isAllUpper) {
+    return segment;
+  }
+  if (segment.includes("_")) {
+    return screamingSnakeToCamel(segment);
+  }
+  return COLLAPSED_UPPERCASE_ALIASES[segment] ?? segment.toLowerCase();
+}
+function resolveExistingKey(target, key) {
+  if (Object.hasOwn(target, key)) {
+    return key;
+  }
+  const lower = key.toLowerCase();
+  for (const existing of Object.keys(target)) {
+    if (existing.toLowerCase() === lower) {
+      return existing;
+    }
+  }
+  return key;
+}
 function setNestedValue(target, pathParts, value) {
   if (pathParts.length === 0) {
     return;
   }
   let current = target;
   for (let index = 0; index < pathParts.length - 1; index += 1) {
-    const key = pathParts[index];
-    if (!key) {
+    const rawKey = pathParts[index];
+    if (!rawKey) {
       return;
     }
+    const key = resolveExistingKey(current, rawKey);
     const next = current[key];
     if (next === void 0 || next === null || typeof next !== "object" || Array.isArray(next)) {
       current[key] = {};
     }
     current = current[key];
   }
-  const leafKey = pathParts[pathParts.length - 1];
-  if (!leafKey) {
+  const rawLeaf = pathParts[pathParts.length - 1];
+  if (!rawLeaf) {
     return;
   }
+  const leafKey = resolveExistingKey(current, rawLeaf);
   current[leafKey] = value;
 }
 function stripRuntimeConfigFields(config2) {
@@ -219,7 +251,7 @@ function applyEnvOverrides(config2, env = process.env) {
     if (!key.startsWith(ENV_PREFIX) || value === void 0) {
       continue;
     }
-    const pathParts = key.slice(ENV_PREFIX.length).split("__").filter(Boolean);
+    const pathParts = key.slice(ENV_PREFIX.length).split("__").filter(Boolean).map(normalizeEnvPathSegment);
     if (pathParts.length === 0) {
       continue;
     }
@@ -550,7 +582,7 @@ function extractSiteConfig(config2) {
   }
   return siteConfig;
 }
-var APITOGO_CONFIG_FILENAME, ENV_PREFIX, DERIVED_MANIFEST_KEYS, SITE_CONFIG_KEYS;
+var APITOGO_CONFIG_FILENAME, ENV_PREFIX, DERIVED_MANIFEST_KEYS, SITE_CONFIG_KEYS, COLLAPSED_UPPERCASE_ALIASES;
 var init_apitogo_config_core = __esm({
   "src/config/apitogo-config-core.ts"() {
     APITOGO_CONFIG_FILENAME = "apitogo.config.json";
@@ -583,6 +615,28 @@ var init_apitogo_config_core = __esm({
       "versions",
       "options"
     ];
+    COLLAPSED_UPPERCASE_ALIASES = {
+      SECRETKEY: "secretKey",
+      WEBHOOKSECRET: "webhookSecret",
+      APIBASEURL: "apiBaseUrl",
+      CLIENTID: "clientId",
+      CLIENTSECRET: "clientSecret",
+      CONNECTIONSTRING: "connectionString",
+      DEMOMODE: "demoMode",
+      DISPLAYNAME: "displayName",
+      PRICEAMOUNT: "priceAmount",
+      PRICECURRENCY: "priceCurrency",
+      BILLINGPERIOD: "billingPeriod",
+      LIMITSJSON: "limitsJson",
+      INCLUDEDACTIONKEYS: "includedActionKeys",
+      SOURCEDIRECTORY: "sourceDirectory",
+      PUBLISHDIRECTORY: "publishDirectory",
+      OPENAPIPATH: "openApiPath",
+      RUNTIMEVERSION: "runtimeVersion",
+      PROJECTID: "projectId",
+      SITENAME: "siteName",
+      LOGOURL: "logoUrl"
+    };
   }
 });
 
@@ -852,7 +906,10 @@ var init_ModulesSchema = __esm({
       sku: z3.string(),
       displayName: z3.string(),
       priceAmount: z3.number().default(0),
-      priceCurrency: z3.string().trim().toLowerCase().regex(/^[a-z]{3}$/, "priceCurrency must be a 3-letter ISO 4217 code (lowercase)").optional(),
+      priceCurrency: z3.string().trim().toLowerCase().regex(
+        /^[a-z]{3}$/,
+        "priceCurrency must be a 3-letter ISO 4217 code (lowercase)"
+      ).optional(),
       billingPeriod: z3.string().optional(),
       limitsJson: z3.string().optional(),
       includedActionKeys: z3.array(z3.string()).optional()
@@ -999,7 +1056,10 @@ var init_local_manifest = __esm({
     init_apitogo_config_loader();
     init_landing_manifest();
     BillingPeriodSchema = z4.enum(["month", "year", "monthly", "annual"]);
-    PriceCurrencySchema = z4.string().trim().toLowerCase().regex(/^[a-z]{3}$/, "priceCurrency must be a 3-letter ISO 4217 code (lowercase)");
+    PriceCurrencySchema = z4.string().trim().toLowerCase().regex(
+      /^[a-z]{3}$/,
+      "priceCurrency must be a 3-letter ISO 4217 code (lowercase)"
+    );
     ALLOWED_RUNTIME_VERSIONS = [
       "DOTNET_10",
       "DOTNET_9",
@@ -1057,7 +1117,9 @@ var init_local_manifest = __esm({
         openApiPath: z4.string().optional(),
         runtime: z4.enum(["dotnet", "nodejs", "python"]).or(z4.string()).optional(),
         runtimeVersion: z4.string().optional().refine(
-          (value) => value === void 0 || ALLOWED_RUNTIME_VERSIONS.includes(value.toUpperCase()) || /^(8(\.0)?|9(\.0)?|10(\.0)?|net8\.0|net9\.0|net10\.0|24|22|3\.(10|11|12|13|14))$/i.test(
+          (value) => value === void 0 || ALLOWED_RUNTIME_VERSIONS.includes(
+            value.toUpperCase()
+          ) || /^(8(\.0)?|9(\.0)?|10(\.0)?|net8\.0|net9\.0|net10\.0|24|22|3\.(10|11|12|13|14))$/i.test(
             value
           ),
           {
@@ -5273,7 +5335,7 @@ import {
 // package.json
 var package_default = {
   name: "@lukoweb/apitogo",
-  version: "0.1.63",
+  version: "0.1.65",
   type: "module",
   sideEffects: [
     "**/*.css",

package/dist/declarations/config/apitogo-config-core.d.ts

@@ -19,6 +19,7 @@ export type AuthenticationSecrets = {
         webhookSecret?: string;
     };
 };
+export declare function normalizeEnvPathSegment(segment: string): string;
 export declare function applyEnvOverrides(config: ApitogoJsonConfig, env?: NodeJS.ProcessEnv): ApitogoJsonConfig;
 type PlanCatalogItem = Record<string, unknown> & {
     sku?: string;

package/docs/configuration/authentication.md

@@ -45,7 +45,7 @@ VITE_APITOGO_AUTHENTICATION_API_BASE_URL=https://your-dev-portal-api.example.com
 ```
 
 You can also set `authentication.apiBaseUrl` in `apitogo.config.json` or
-`APITOGO_CONFIG_authentication__apiBaseUrl` in `.env`.
+`APITOGO_CONFIG_AUTHENTICATION__API_BASE_URL` in `.env`.
 
 **Local demo mode:** In development (`npm run dev`), `demoMode` is enabled by default when the user
 panel is on. You do not need `VITE_APITOGO_AUTHENTICATION_API_BASE_URL`, OIDC, or a running
@@ -55,7 +55,7 @@ dev-portal backend to explore protected account pages locally. Sign in at `/logi
 demo@apitogo.local / password
 ```
 
-Disable with `APITOGO_CONFIG_demoMode=false` in `.env` or `"demoMode": false` in
+Disable with `APITOGO_CONFIG_DEMO_MODE=false` in `.env` or `"demoMode": false` in
 `apitogo.config.json`. Demo mode is never active in production builds.
 
 **Local preview (demo off):** When the backend URL is a placeholder or unreachable and demo mode is
@@ -70,7 +70,7 @@ without restarting the dev server.
 | -------------------------------------------------------- | -------------------------------------------------------------------------- |
 | Site, plans, modules, branding, backend/gateway metadata | `apitogo.config.json` (+ `.env` overrides — see [Manifest](./manifest.md)) |
 | Plugins and custom code                                  | `apitogo.config.tsx`                                                       |
-| OIDC and Stripe for publish                              | `.env.local` via `APITOGO_CONFIG_authentication__*`                        |
+| OIDC and Stripe for publish                              | `.env` via `APITOGO_CONFIG_AUTHENTICATION__*`                              |
 
 **Production:** Register one OIDC app with redirect URI `https://{backend}/signin-oidc` (see MCP
 `manualSteps.oidcRedirectUri`). The frontend uses cookie sessions via `credentials: "include"` on

package/docs/configuration/manifest.md

@@ -9,7 +9,7 @@ metadata. Code-only pieces (plugins, custom components) stay in `apitogo.config.
 | --------------------- | ----------------------------------------------------------- |
 | `apitogo.config.json` | Committed defaults: site, modules, authentication, backend  |
 | `apitogo.config.tsx`  | Plugins and other non-JSON configuration                    |
-| `.env` / `.env.local` | Public client vars + publish secrets via `APITOGO_CONFIG_*` |
+| `.env`                | Public client vars + publish secrets via `APITOGO_CONFIG_*` |
 
 ## Canonical shape
 
@@ -70,23 +70,23 @@ Public client URL (mirrors `authentication.apiBaseUrl`):
 VITE_APITOGO_AUTHENTICATION_API_BASE_URL=https://your-dev-portal-api.example.com
 ```
 
-Nested config overrides:
+Nested config overrides (uppercase SCREAMING_SNAKE path segments; camelCase still accepted):
 
 ```sh
-APITOGO_CONFIG_site__title=My Local Site
-APITOGO_CONFIG_pricing__enabled=true
-APITOGO_CONFIG_projectId=your-local-project-id
-APITOGO_CONFIG_authentication__apiBaseUrl=https://your-dev-portal-api.example.com
+APITOGO_CONFIG_SITE__TITLE=My Local Site
+APITOGO_CONFIG_PRICING__ENABLED=true
+APITOGO_CONFIG_PROJECT_ID=your-local-project-id
+APITOGO_CONFIG_AUTHENTICATION__API_BASE_URL=https://your-dev-portal-api.example.com
 ```
 
-Publish secrets (`.env.local`, never commit):
+Publish secrets (uncomment in `.env`, never commit):
 
 ```sh
-APITOGO_CONFIG_authentication__oidc__authority=https://login.example.com
-APITOGO_CONFIG_authentication__oidc__clientId=your-client-id
-APITOGO_CONFIG_authentication__oidc__clientSecret=your-client-secret
-APITOGO_CONFIG_authentication__stripe__secretKey=sk_test_...
-APITOGO_CONFIG_authentication__stripe__webhookSecret=whsec_...
+APITOGO_CONFIG_AUTHENTICATION__OIDC__AUTHORITY=https://login.example.com
+APITOGO_CONFIG_AUTHENTICATION__OIDC__CLIENT_ID=your-client-id
+APITOGO_CONFIG_AUTHENTICATION__OIDC__CLIENT_SECRET=your-client-secret
+APITOGO_CONFIG_AUTHENTICATION__STRIPE__SECRET_KEY=sk_test_...
+APITOGO_CONFIG_AUTHENTICATION__STRIPE__WEBHOOK_SECRET=whsec_...
 ```
 
 ## Thin `apitogo.config.tsx`

package/docs/guides/environment-variables.md

@@ -26,7 +26,7 @@ environment-specific variables. See the
 [Vite documentation](https://vite.dev/guide/env-and-mode.html#env-files) for more information on
 supported files.
 
-Here is an example of a `.env.local` file:
+Here is an example of a `.env` file:
 
 ```sh
 APITOGO_PUBLIC_PAGE_TITLE=My Page Title

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@lukoweb/apitogo",
-  "version": "0.1.63",
+  "version": "0.1.65",
   "type": "module",
   "sideEffects": [
     "**/*.css",

package/src/config/apitogo-config-core.ts

@@ -47,7 +47,7 @@ export type AuthenticationSecrets = {
   email?: {
     connectionString?: string;
   };
-  /** Provider secrets keyed by provider `id` (from env: `authentication__providers__{id}__clientSecret`). */
+  /** Provider secrets keyed by provider `id` (from env: `AUTHENTICATION__PROVIDERS__{id}__CLIENT_SECRET`). */
   providers?: Record<string, { clientSecret?: string }>;
   stripe?: {
     secretKey?: string;
@@ -89,6 +89,81 @@ function parseEnvValue(raw: string | undefined): unknown {
   return trimmed;
 }
 
+/** Collapsed ALLCAPS aliases for multi-word camelCase config keys. */
+const COLLAPSED_UPPERCASE_ALIASES: Record<string, string> = {
+  SECRETKEY: "secretKey",
+  WEBHOOKSECRET: "webhookSecret",
+  APIBASEURL: "apiBaseUrl",
+  CLIENTID: "clientId",
+  CLIENTSECRET: "clientSecret",
+  CONNECTIONSTRING: "connectionString",
+  DEMOMODE: "demoMode",
+  DISPLAYNAME: "displayName",
+  PRICEAMOUNT: "priceAmount",
+  PRICECURRENCY: "priceCurrency",
+  BILLINGPERIOD: "billingPeriod",
+  LIMITSJSON: "limitsJson",
+  INCLUDEDACTIONKEYS: "includedActionKeys",
+  SOURCEDIRECTORY: "sourceDirectory",
+  PUBLISHDIRECTORY: "publishDirectory",
+  OPENAPIPATH: "openApiPath",
+  RUNTIMEVERSION: "runtimeVersion",
+  PROJECTID: "projectId",
+  SITENAME: "siteName",
+  LOGOURL: "logoUrl",
+};
+
+function screamingSnakeToCamel(segment: string): string {
+  return segment
+    .toLowerCase()
+    .split("_")
+    .filter(Boolean)
+    .map((part, index) =>
+      index === 0 ? part : `${part.charAt(0).toUpperCase()}${part.slice(1)}`,
+    )
+    .join("");
+}
+
+/**
+ * Normalize one `APITOGO_CONFIG_*` path segment to the JSON key casing.
+ * - Mixed/camelCase → leave as-is (legacy)
+ * - `SECRET_KEY` → `secretKey`
+ * - `AUTHENTICATION` → `authentication`
+ * - `SECRETKEY` → `secretKey` (collapsed alias)
+ */
+export function normalizeEnvPathSegment(segment: string): string {
+  if (!segment) {
+    return segment;
+  }
+
+  const isAllUpper = segment === segment.toUpperCase() && /[A-Z]/.test(segment);
+  if (!isAllUpper) {
+    return segment;
+  }
+
+  if (segment.includes("_")) {
+    return screamingSnakeToCamel(segment);
+  }
+
+  return COLLAPSED_UPPERCASE_ALIASES[segment] ?? segment.toLowerCase();
+}
+
+function resolveExistingKey(
+  target: Record<string, unknown>,
+  key: string,
+): string {
+  if (Object.hasOwn(target, key)) {
+    return key;
+  }
+  const lower = key.toLowerCase();
+  for (const existing of Object.keys(target)) {
+    if (existing.toLowerCase() === lower) {
+      return existing;
+    }
+  }
+  return key;
+}
+
 function setNestedValue(
   target: Record<string, unknown>,
   pathParts: string[],
@@ -100,10 +175,11 @@ function setNestedValue(
 
   let current: Record<string, unknown> = target;
   for (let index = 0; index < pathParts.length - 1; index += 1) {
-    const key = pathParts[index];
-    if (!key) {
+    const rawKey = pathParts[index];
+    if (!rawKey) {
       return;
     }
+    const key = resolveExistingKey(current, rawKey);
     const next = current[key];
     if (
       next === undefined ||
@@ -116,11 +192,12 @@ function setNestedValue(
     current = current[key] as Record<string, unknown>;
   }
 
-  const leafKey = pathParts[pathParts.length - 1];
-  if (!leafKey) {
+  const rawLeaf = pathParts[pathParts.length - 1];
+  if (!rawLeaf) {
     return;
   }
 
+  const leafKey = resolveExistingKey(current, rawLeaf);
   current[leafKey] = value;
 }
 
@@ -144,7 +221,11 @@ export function applyEnvOverrides(
       continue;
     }
 
-    const pathParts = key.slice(ENV_PREFIX.length).split("__").filter(Boolean);
+    const pathParts = key
+      .slice(ENV_PREFIX.length)
+      .split("__")
+      .filter(Boolean)
+      .map(normalizeEnvPathSegment);
 
     if (pathParts.length === 0) {
       continue;

package/src/config/local-manifest.ts

@@ -32,7 +32,10 @@ const PriceCurrencySchema = z
   .string()
   .trim()
   .toLowerCase()
-  .regex(/^[a-z]{3}$/, "priceCurrency must be a 3-letter ISO 4217 code (lowercase)");
+  .regex(
+    /^[a-z]{3}$/,
+    "priceCurrency must be a 3-letter ISO 4217 code (lowercase)",
+  );
 
 export const ALLOWED_RUNTIME_VERSIONS = [
   "DOTNET_10",
@@ -116,7 +119,9 @@ export const DevPortalLocalManifestSchema = z.object({
         .refine(
           (value) =>
             value === undefined ||
-            (ALLOWED_RUNTIME_VERSIONS as readonly string[]).includes(value.toUpperCase()) ||
+            (ALLOWED_RUNTIME_VERSIONS as readonly string[]).includes(
+              value.toUpperCase(),
+            ) ||
             /^(8(\.0)?|9(\.0)?|10(\.0)?|net8\.0|net9\.0|net10\.0|24|22|3\.(10|11|12|13|14))$/i.test(
               value,
             ),

package/src/config/validators/ModulesSchema.ts

@@ -266,7 +266,10 @@ const PlanCatalogItemSchema = z.object({
     .string()
     .trim()
     .toLowerCase()
-    .regex(/^[a-z]{3}$/, "priceCurrency must be a 3-letter ISO 4217 code (lowercase)")
+    .regex(
+      /^[a-z]{3}$/,
+      "priceCurrency must be a 3-letter ISO 4217 code (lowercase)",
+    )
     .optional(),
   billingPeriod: z.string().optional(),
   limitsJson: z.string().optional(),