timonel 3.0.0-beta.1 → 3.1.0-beta.1

package/SECURITY.md

@@ -36,13 +36,14 @@ We provide security updates for the following versions:
 
 <!-- markdownlint-disable MD060 -->
 
-| Version | Supported      | Security Updates | End of Life |
-| ------- | -------------- | ---------------- | ----------- |
-| 2.4.0+  | ✅ Current     | Full support     | TBD         |
-| 2.3.x   | ✅ Supported   | Full support     | TBD         |
-| 2.0-2.2 | ⚠️ Limited     | Critical only    | 2024-12-31  |
-| 1.x.x   | ❌ End of life | None             | 2024-06-30  |
-| < 1.0   | ❌ End of life | None             | 2024-01-01  |
+| Version      | Supported      | Security Updates | End of Life |
+| ------------ | -------------- | ---------------- | ----------- |
+| 3.0.0-beta.1 | ✅ Current     | Full support     | TBD         |
+| 2.14.x       | ✅ Supported   | Full support     | TBD         |
+| 2.8.0-2.13.x | ✅ Supported   | Full support     | 2025-06-30  |
+| 2.0-2.7.x    | ⚠️ Limited     | Critical only    | 2025-03-31  |
+| 1.x.x        | ❌ End of life | None             | 2024-06-30  |
+| < 1.0        | ❌ End of life | None             | 2024-01-01  |
 
 **Update policy:**
 
@@ -83,15 +84,28 @@ We provide security updates for the following versions:
 ### Security Features
 
 - **Input validation**: Comprehensive path traversal prevention and sanitization via SecurityUtils
-- **Log injection protection**: All user inputs sanitized before logging
-- **Code injection prevention**: Strict validation for dynamic module loading
-- **TypeScript strict mode**: Compile-time safety checks
+  - CWE-22/23: Path traversal protection with URL-encoded sequence detection
+  - CWE-20: Proper input validation for CLI flags (--set, --env)
+  - Null byte injection prevention
+  - Reserved key validation in resource providers
+- **Log injection protection**: All user inputs sanitized before logging (CWE-117)
+- **Code injection prevention**: Strict validation for dynamic module loading (CWE-94)
+  - Regex escaping for dynamic pattern construction
+  - Function name validation before template generation
+- **Command injection prevention**: Validated inputs for all shell commands (CWE-78/77/88)
+  - Release name validation (RFC 1123 subdomain)
+  - Namespace validation (Kubernetes naming rules)
+  - --set flag validation with support for nested paths and arrays
+- **TypeScript strict mode**: Compile-time safety checks with all strict options enabled
 - **No eval()**: Static code generation only
 - **File system isolation**: Controlled output directory access with path validation
+  - Absolute path support with explicit allowAbsolute flag
+  - Base directory validation for all file operations
 - **Helm template validation**: Input validation for all template functions
 - **Karpenter security**: Secure node pool and scheduling configurations
 - **Performance optimization**: Efficient algorithms preventing DoS via resource exhaustion
-- **OWASP compliance**: Following secure coding guidelines (CWE-22, CWE-94, CWE-117)
+- **OWASP compliance**: Following secure coding guidelines (CWE-22, CWE-23, CWE-94, CWE-117,
+  CWE-78, CWE-77, CWE-88, CWE-20)
 
 ## Security Considerations for Users
 

package/dist/cli.js

@@ -142,8 +142,9 @@ async function cmdInit(name, silent = false) {
     if (!SecurityUtils.isValidChartName(validName)) {
         usageAndExit('Invalid chart name. Must be lowercase, start with a letter, and contain only letters, numbers, and dashes.');
     }
-    const base = path.join(process.cwd(), validName);
-    const chartFile = path.join(base, 'chart.ts');
+    const cwd = process.cwd();
+    const base = SecurityUtils.validatePath(path.join(cwd, validName), cwd);
+    const chartFile = SecurityUtils.validatePath(path.join(base, 'chart.ts'), cwd);
     fs.mkdirSync(base, { recursive: true });
     const { generateFlexibleSubchartTemplate } = await import('./lib/templates/flexible-subchart.js');
     fs.writeFileSync(chartFile, generateFlexibleSubchartTemplate(validName));
@@ -152,19 +153,31 @@ async function cmdInit(name, silent = false) {
     log(`Run 'tl synth ${validName}' to generate complete Helm chart`, silent);
 }
 async function cmdSynth(chartDirOrOutDir, flags, explicitOutDir) {
-    let chartDir = process.cwd();
+    const cwd = process.cwd();
+    let chartDir = cwd;
     let outDir;
-    if (chartDirOrOutDir && fs.existsSync(path.join(chartDirOrOutDir, 'chart.ts'))) {
-        chartDir = path.resolve(chartDirOrOutDir);
-    }
-    else {
-        outDir = chartDirOrOutDir;
+    if (chartDirOrOutDir) {
+        const resolvedPath = path.resolve(chartDirOrOutDir);
+        const validatedPath = SecurityUtils.validatePath(resolvedPath, cwd, { allowAbsolute: true });
+        const chartTsPath = SecurityUtils.validatePath(path.join(validatedPath, 'chart.ts'), cwd, {
+            allowAbsolute: true,
+        });
+        if (fs.existsSync(chartTsPath)) {
+            chartDir = validatedPath;
+        }
+        else {
+            outDir = chartDirOrOutDir;
+        }
     }
     if (explicitOutDir) {
         outDir = explicitOutDir;
     }
-    const chartFile = path.join(chartDir, 'chart.ts');
-    const defaultOutDir = path.join(chartDir, 'dist');
+    const chartFile = SecurityUtils.validatePath(path.join(chartDir, 'chart.ts'), cwd, {
+        allowAbsolute: true,
+    });
+    const defaultOutDir = SecurityUtils.validatePath(path.join(chartDir, 'dist'), cwd, {
+        allowAbsolute: true,
+    });
     if (!fs.existsSync(chartFile)) {
         console.error('chart.ts not found. Run `tl init` first.');
         process.exit(1);
@@ -177,7 +190,7 @@ async function cmdSynth(chartDirOrOutDir, flags, explicitOutDir) {
     if (modifiedContent === originalContent) {
         modifiedContent = originalContent.replace(/chart\.write\(['"][^'"]*['"]\)/, `chart.write('${safeOutDirLiteral}')`);
     }
-    const tempChartFile = path.join(chartDir, '.timonel-temp-chart.ts');
+    const tempChartFile = SecurityUtils.validatePath(path.join(chartDir, '.timonel-temp-chart.ts'), cwd, { allowAbsolute: true });
     fs.writeFileSync(tempChartFile, modifiedContent);
     const wrapperScript = `
 import { pathToFileURL } from 'url';
@@ -237,11 +250,34 @@ async function cmdValidate(flags) {
         process.exit(result.status ?? 1);
     }
 }
+function validateReleaseName(release) {
+    if (!/^[a-z0-9]([-a-z0-9]*[a-z0-9])?$/.test(release) || release.length > 53) {
+        console.error(`Invalid release name: ${SecurityUtils.sanitizeLogMessage(release)}`);
+        console.error('Release name must be lowercase alphanumeric with hyphens (max 53 chars)');
+        process.exit(1);
+    }
+}
+function validateNamespace(namespace) {
+    if (!/^[a-z0-9]([-a-z0-9]*[a-z0-9])?$/.test(namespace) || namespace.length > 63) {
+        console.error(`Invalid namespace: ${SecurityUtils.sanitizeLogMessage(namespace)}`);
+        console.error('Namespace must be lowercase alphanumeric with hyphens (max 63 chars)');
+        process.exit(1);
+    }
+}
+function validateSetFlag(setValue) {
+    if (!/^[a-zA-Z0-9._[\]-]+=.+$/.test(setValue)) {
+        console.error(`Invalid --set format: ${SecurityUtils.sanitizeLogMessage(setValue)}`);
+        console.error('Expected format: key=value');
+        process.exit(1);
+    }
+}
 async function cmdDeploy(release, namespace, flags) {
     if (!release)
         usageAndExit('Missing <release>');
+    validateReleaseName(release);
     const args = ['upgrade', '--install', release, '.'];
     if (namespace) {
+        validateNamespace(namespace);
         args.push('--namespace', namespace);
     }
     if (flags?.env) {
@@ -256,6 +292,7 @@ async function cmdDeploy(release, namespace, flags) {
     }
     if (flags?.set) {
         for (const setValue of flags.set) {
+            validateSetFlag(setValue);
             args.push('--set', setValue);
         }
     }
@@ -465,7 +502,7 @@ async function cmdUmbrellaAdd(subchartPath, silent = false) {
     fs.mkdirSync(subchartDir, { recursive: true });
     const relativeSubchartPath = path.relative(chartsRoot, subchartDir) || subchartName;
     const normalizedSubchartPath = relativeSubchartPath.split(path.sep).join('/');
-    const chartFile = path.join(subchartDir, 'chart.ts');
+    const chartFile = SecurityUtils.validatePath(path.join(subchartDir, 'chart.ts'), chartsRoot);
     const { generateFlexibleSubchartTemplate } = await import('./lib/templates/flexible-subchart.js');
     const subchartContent = generateFlexibleSubchartTemplate(subchartName);
     fs.writeFileSync(chartFile, subchartContent);
@@ -479,8 +516,9 @@ async function cmdUmbrellaAdd(subchartPath, silent = false) {
     log(`Subchart ${subchartName} added to umbrella at path '${normalizedSubchartPath}'`, silent);
 }
 async function cmdUmbrellaSynth(outDir, flags) {
-    const umbrellaFile = path.join(process.cwd(), UMBRELLA_FILE_NAME);
-    const defaultOutDir = path.join(process.cwd(), 'dist');
+    const cwd = process.cwd();
+    const umbrellaFile = SecurityUtils.validatePath(path.join(cwd, UMBRELLA_FILE_NAME), cwd);
+    const defaultOutDir = SecurityUtils.validatePath(path.join(cwd, 'dist'), cwd);
     if (!fs.existsSync(umbrellaFile)) {
         console.error('umbrella.ts not found. Run `tl umbrella init` first.');
         process.exit(1);
@@ -511,7 +549,8 @@ fs.mkdirSync(output, { recursive: true });
 await Promise.resolve(runner(output, synthOptions));
 console.log('Umbrella chart written to ' + output);
 `;
-    const wrapperFile = path.join(process.cwd(), '.timonel-umbrella-wrapper.mjs');
+    const cwd = process.cwd();
+    const wrapperFile = SecurityUtils.validatePath(path.join(cwd, '.timonel-umbrella-wrapper.mjs'), cwd);
     try {
         fs.writeFileSync(wrapperFile, wrapperScript);
         const result = spawnSync(process.execPath, [TSX_CLI_PATH, wrapperFile], {

package/dist/index.d.ts

@@ -3,9 +3,12 @@ export * from './lib/helmChartWriter.js';
 export * from './lib/rutter.js';
 export * from './lib/security.js';
 export * from './lib/umbrella.js';
+export * from './lib/policy/index.js';
+export * from './lib/validation/inputValidator.js';
 export { FlexibleSubchart, createFlexibleSubchart } from './lib/templates/flexible-subchart.js';
 export { UmbrellaChartTemplate as UmbrellaChart } from './lib/templates/umbrella-chart.js';
 export type { ChartProps, SubchartProps } from './lib/types.js';
+export type { PolicyConfig, PolicyRule, PolicyContext, PluginConfig } from './types/index.js';
 export type { AWSALBIngressSpec, AWSEBSStorageClassSpec, AWSEFSStorageClassSpec, AWSIRSAServiceAccountSpec, } from './lib/resources/cloud/aws/awsResources.js';
 export type { KarpenterDisruption, KarpenterDisruptionBudget, KarpenterEC2NodeClassSpec, KarpenterNodeClaimSpec, KarpenterNodePoolSpec, } from './lib/resources/cloud/aws/karpenterResources.js';
 export { DEFAULT_TERMINATION_GRACE_PERIOD, isValidDisruptionBudget, isValidKubernetesDuration, KarpenterVersionUtils, } from './lib/resources/cloud/aws/karpenterResources.js';

package/dist/index.js

@@ -3,6 +3,8 @@ export * from './lib/helmChartWriter.js';
 export * from './lib/rutter.js';
 export * from './lib/security.js';
 export * from './lib/umbrella.js';
+export * from './lib/policy/index.js';
+export * from './lib/validation/inputValidator.js';
 export { FlexibleSubchart, createFlexibleSubchart } from './lib/templates/flexible-subchart.js';
 export { UmbrellaChartTemplate as UmbrellaChart } from './lib/templates/umbrella-chart.js';
 export { DEFAULT_TERMINATION_GRACE_PERIOD, isValidDisruptionBudget, isValidKubernetesDuration, KarpenterVersionUtils, } from './lib/resources/cloud/aws/karpenterResources.js';

package/dist/lib/helm.js

@@ -36,6 +36,12 @@ export function indent(n, expr) {
         .join('\n');
 }
 export function template(name, context = '.') {
+    if (!isValidHelmPath(name)) {
+        throw new Error(`Invalid template name: ${name}`);
+    }
+    if (!isValidHelmPath(context)) {
+        throw new Error(`Invalid template context: ${context}`);
+    }
     return `{{ template "${name}" ${context} }}`;
 }
 export function include(name, context = '.') {
@@ -157,12 +163,33 @@ export function helmRange(collection, content, options = {}) {
     if (!collection.startsWith('.')) {
         throw new Error('Collection path must start with "." (e.g., ".Values.items")');
     }
+    if (!isValidHelmPath(collection)) {
+        throw new Error(`Invalid collection path: ${collection}`);
+    }
     const { keyValue = false, keyVar = '$key', valueVar = '$value', indexVar = '$index', itemVar = '$item', } = options;
+    const validateVarName = (varName, varType) => {
+        if (!varName.startsWith('$')) {
+            throw new Error(`${varType} must start with $ (e.g., $key, $value)`);
+        }
+        if (!/^\$[a-zA-Z_][a-zA-Z0-9_]*$/.test(varName)) {
+            throw new Error(`Invalid ${varType}: ${varName}`);
+        }
+    };
+    if (keyValue) {
+        validateVarName(keyVar, 'keyVar');
+        validateVarName(valueVar, 'valueVar');
+    }
+    if (options.indexVar !== undefined) {
+        validateVarName(indexVar, 'indexVar');
+    }
+    if (options.itemVar !== undefined) {
+        validateVarName(itemVar, 'itemVar');
+    }
     let rangeExpression;
     if (keyValue) {
         rangeExpression = `{{- range ${keyVar}, ${valueVar} := ${collection} }}`;
     }
-    else if (options.indexVar && options.itemVar) {
+    else if (options.indexVar !== undefined && options.itemVar !== undefined) {
         rangeExpression = `{{- range ${indexVar}, ${itemVar} := ${collection} }}`;
     }
     else {

package/dist/lib/helmChartWriter.js

@@ -35,7 +35,8 @@ export class HelmChartWriter {
         timer();
     }
     static createDirectories(outDir) {
-        fs.mkdirSync(path.join(outDir, 'templates'), { recursive: true });
+        const templatesDir = SecurityUtils.validatePath(path.join(outDir, 'templates'), outDir);
+        fs.mkdirSync(templatesDir, { recursive: true });
     }
     static writeChartYaml(outDir, meta) {
         const chartYaml = dumpHelmAwareYaml({
@@ -53,13 +54,16 @@ export class HelmChartWriter {
             icon: meta.icon,
             dependencies: meta.dependencies,
         });
-        fs.writeFileSync(path.join(outDir, 'Chart.yaml'), chartYaml);
+        const chartYamlPath = SecurityUtils.validatePath(path.join(outDir, 'Chart.yaml'), outDir);
+        fs.writeFileSync(chartYamlPath, chartYaml);
     }
     static writeValuesFiles(outDir, defaultValues, envValues) {
-        fs.writeFileSync(path.join(outDir, 'values.yaml'), dumpHelmAwareYaml(defaultValues));
+        const valuesPath = SecurityUtils.validatePath(path.join(outDir, 'values.yaml'), outDir);
+        fs.writeFileSync(valuesPath, dumpHelmAwareYaml(defaultValues));
         for (const [env, values] of Object.entries(envValues)) {
             const sanitizedEnv = SecurityUtils.sanitizeEnvironmentName(env);
-            fs.writeFileSync(path.join(outDir, `values-${sanitizedEnv}.yaml`), dumpHelmAwareYaml(values));
+            const envValuesPath = SecurityUtils.validatePath(path.join(outDir, `values-${sanitizedEnv}.yaml`), outDir);
+            fs.writeFileSync(envValuesPath, dumpHelmAwareYaml(values));
         }
     }
     static writeAssets(outDir, assets) {
@@ -77,20 +81,23 @@ export class HelmChartWriter {
                 .map((h) => [`{{- define "${h.name}" -}}`, h.template.trimEnd(), '{{- end }}', ''].join('\n'))
                 .join('\n');
         }
-        fs.writeFileSync(path.join(outDir, 'templates', '_helpers.tpl'), content);
+        const helpersPath = SecurityUtils.validatePath(path.join(outDir, 'templates', '_helpers.tpl'), outDir);
+        fs.writeFileSync(helpersPath, content);
     }
     static writeNotes(outDir, notesTpl) {
         if (!notesTpl)
             return;
-        fs.writeFileSync(path.join(outDir, 'templates', 'NOTES.txt'), notesTpl.endsWith('\n') ? notesTpl : notesTpl + '\n');
+        const notesPath = SecurityUtils.validatePath(path.join(outDir, 'templates', 'NOTES.txt'), outDir);
+        fs.writeFileSync(notesPath, notesTpl.endsWith('\n') ? notesTpl : notesTpl + '\n');
     }
     static writeSchema(outDir, valuesSchema) {
         if (!valuesSchema)
             return;
-        fs.writeFileSync(path.join(outDir, 'values.schema.json'), JSON.stringify(valuesSchema, null, 2) + '\n');
+        const schemaPath = SecurityUtils.validatePath(path.join(outDir, 'values.schema.json'), outDir);
+        fs.writeFileSync(schemaPath, JSON.stringify(valuesSchema, null, 2) + '\n');
     }
     static writeHelmIgnore(outDir) {
-        const helmIgnorePath = path.join(outDir, '.helmignore');
+        const helmIgnorePath = SecurityUtils.validatePath(path.join(outDir, '.helmignore'), outDir);
         if (!fs.existsSync(helmIgnorePath)) {
             const helmIgnore = [
                 '# VCS',
@@ -149,7 +156,13 @@ function writeSingleAssetFile(outDir, targetDir, directorySegments, fileBaseName
     const chartSubdir = path.join(outDir, targetDir, ...directorySegments);
     SecurityUtils.validatePath(chartSubdir, outDir);
     fs.mkdirSync(chartSubdir, { recursive: true });
+    if (fileBaseName.includes('..') || fileBaseName.includes('/') || fileBaseName.includes('\\')) {
+        throw new Error(`Invalid fileBaseName: ${fileBaseName}`);
+    }
     const filename = `${fileBaseName}.yaml`;
+    if (filename.includes('..') || filename.includes('/') || filename.includes('\\')) {
+        throw new Error(`Invalid filename: ${filename}`);
+    }
     const absolutePath = path.join(chartSubdir, filename);
     SecurityUtils.validatePath(absolutePath, outDir);
     const processedYaml = postProcessFieldConditionals(yaml);
@@ -162,8 +175,14 @@ function writeMultipleAssetFiles(outDir, targetDir, directorySegments, fileBaseN
     const processedYaml = postProcessFieldConditionals(yaml);
     const parts = splitDocs(processedYaml);
     parts.forEach((doc, index) => {
+        if (fileBaseName.includes('..') || fileBaseName.includes('/') || fileBaseName.includes('\\')) {
+            throw new Error(`Invalid fileBaseName: ${fileBaseName}`);
+        }
         const suffix = parts.length > 1 ? `-${index + 1}` : '';
         const filename = `${fileBaseName}${suffix}.yaml`;
+        if (filename.includes('..') || filename.includes('/') || filename.includes('\\')) {
+            throw new Error(`Invalid filename: ${filename}`);
+        }
         const absolutePath = path.join(chartSubdir, filename);
         SecurityUtils.validatePath(absolutePath, outDir);
         fs.writeFileSync(absolutePath, doc.endsWith('\n') ? doc : `${doc}\n`);

package/dist/lib/policy/configurationLoader.d.ts

@@ -0,0 +1,46 @@
+import type { JSONSchema, PolicyPlugin, ConfigurationLoaderOptions } from './types.js';
+export type ConfigurationSource = 'environment' | 'file' | 'inline' | 'default';
+export interface ConfigurationEntry {
+    readonly value: unknown;
+    readonly source: ConfigurationSource;
+    readonly environment?: string;
+    readonly priority: number;
+    readonly schema?: JSONSchema;
+}
+export interface PluginConfiguration {
+    readonly pluginName: string;
+    readonly config: Record<string, unknown>;
+    readonly entries: ConfigurationEntry[];
+    readonly validated: boolean;
+    readonly validationErrors?: string[];
+}
+export interface EnvironmentConfiguration {
+    readonly environment: string;
+    readonly plugins: Record<string, unknown>;
+    readonly global?: Record<string, unknown>;
+}
+export declare class ConfigurationLoader {
+    private readonly options;
+    private readonly logger;
+    private readonly configurations;
+    private readonly environmentConfigs;
+    constructor(options?: ConfigurationLoaderOptions);
+    loadPluginConfiguration(plugin: PolicyPlugin, environment?: string, inlineConfig?: Record<string, unknown>): Promise<PluginConfiguration>;
+    private collectConfigurationEntries;
+    private validatePluginConfiguration;
+    loadEnvironmentConfiguration(environment: string): Promise<EnvironmentConfiguration | undefined>;
+    validateConfiguration(config: Record<string, unknown>, schema: JSONSchema, pluginName: string): void;
+    addConfigurationEntry(pluginName: string, entry: ConfigurationEntry): void;
+    getConfigurationEntries(pluginName: string): ConfigurationEntry[];
+    clearCache(): void;
+    private loadFileConfiguration;
+    private loadEnvironmentVariableConfiguration;
+    private loadEnvironmentFromFiles;
+    private mergeConfigurations;
+    private parseEnvironmentValue;
+    private validateAgainstSchema;
+    private validateBasicType;
+    private validateObjectProperties;
+    private validateRequiredProperties;
+    private validateEachProperty;
+}

package/dist/lib/policy/configurationLoader.js

@@ -0,0 +1,251 @@
+import { createLogger } from '../utils/logger.js';
+import { PluginConfigurationError } from './errors.js';
+const DEFAULT_LOADER_OPTIONS = {
+    defaultEnvironment: 'development',
+    validateSchemas: true,
+    allowUnknownProperties: false,
+    configurationFiles: [],
+    environmentPrefix: 'TIMONEL_POLICY',
+};
+const CONFIGURATION_PRIORITIES = {
+    default: 0,
+    file: 10,
+    environment: 20,
+    inline: 30,
+};
+export class ConfigurationLoader {
+    constructor(options = {}) {
+        this.configurations = new Map();
+        this.environmentConfigs = new Map();
+        this.options = { ...DEFAULT_LOADER_OPTIONS, ...options };
+        this.logger = createLogger('policy-config-loader');
+        this.logger.debug('ConfigurationLoader initialized', {
+            options: this.options,
+            operation: 'config_loader_init',
+        });
+    }
+    async loadPluginConfiguration(plugin, environment, inlineConfig) {
+        const targetEnvironment = environment || this.options.defaultEnvironment;
+        this.logger.debug('Loading plugin configuration', {
+            pluginName: plugin.name,
+            environment: targetEnvironment,
+            hasInlineConfig: inlineConfig !== undefined,
+            operation: 'load_plugin_config',
+        });
+        const entries = await this.collectConfigurationEntries(plugin, targetEnvironment, inlineConfig);
+        const mergedConfig = this.mergeConfigurations(entries);
+        const validationResult = this.validatePluginConfiguration(plugin, mergedConfig);
+        const result = {
+            pluginName: plugin.name,
+            config: mergedConfig,
+            entries,
+            validated: validationResult.validated,
+            ...(validationResult.validationErrors && {
+                validationErrors: validationResult.validationErrors,
+            }),
+        };
+        this.logger.info('Plugin configuration loaded', {
+            pluginName: plugin.name,
+            environment: targetEnvironment,
+            entryCount: entries.length,
+            validated: validationResult.validated,
+            hasErrors: validationResult.validationErrors !== undefined,
+            operation: 'plugin_config_loaded',
+        });
+        return result;
+    }
+    async collectConfigurationEntries(plugin, targetEnvironment, inlineConfig) {
+        const entries = [];
+        if (plugin.metadata?.defaultConfig) {
+            entries.push({
+                value: plugin.metadata.defaultConfig,
+                source: 'default',
+                priority: CONFIGURATION_PRIORITIES.default,
+                ...(plugin.configSchema && { schema: plugin.configSchema }),
+            });
+        }
+        const fileConfig = await this.loadFileConfiguration(plugin.name, targetEnvironment);
+        if (fileConfig) {
+            entries.push({
+                value: fileConfig,
+                source: 'file',
+                environment: targetEnvironment,
+                priority: CONFIGURATION_PRIORITIES.file,
+                ...(plugin.configSchema && { schema: plugin.configSchema }),
+            });
+        }
+        const envConfig = this.loadEnvironmentVariableConfiguration(plugin.name);
+        if (envConfig) {
+            entries.push({
+                value: envConfig,
+                source: 'environment',
+                priority: CONFIGURATION_PRIORITIES.environment,
+                ...(plugin.configSchema && { schema: plugin.configSchema }),
+            });
+        }
+        if (inlineConfig) {
+            entries.push({
+                value: inlineConfig,
+                source: 'inline',
+                priority: CONFIGURATION_PRIORITIES.inline,
+                ...(plugin.configSchema && { schema: plugin.configSchema }),
+            });
+        }
+        return entries;
+    }
+    validatePluginConfiguration(plugin, mergedConfig) {
+        let validated = false;
+        let validationErrors;
+        if (this.options.validateSchemas && plugin.configSchema) {
+            try {
+                this.validateConfiguration(mergedConfig, plugin.configSchema, plugin.name);
+                validated = true;
+            }
+            catch (error) {
+                validationErrors = [error instanceof Error ? error.message : String(error)];
+                this.logger.warn('Plugin configuration validation failed', {
+                    pluginName: plugin.name,
+                    errors: validationErrors,
+                    operation: 'config_validation_failed',
+                });
+            }
+        }
+        return { validated, ...(validationErrors && { validationErrors }) };
+    }
+    async loadEnvironmentConfiguration(environment) {
+        if (this.environmentConfigs.has(environment)) {
+            return this.environmentConfigs.get(environment);
+        }
+        this.logger.debug('Loading environment configuration', {
+            environment,
+            operation: 'load_env_config',
+        });
+        const envConfig = await this.loadEnvironmentFromFiles(environment);
+        if (envConfig) {
+            this.environmentConfigs.set(environment, envConfig);
+            this.logger.info('Environment configuration loaded', {
+                environment,
+                pluginCount: Object.keys(envConfig.plugins).length,
+                hasGlobal: envConfig.global !== undefined,
+                operation: 'env_config_loaded',
+            });
+        }
+        return envConfig;
+    }
+    validateConfiguration(config, schema, pluginName) {
+        try {
+            this.validateAgainstSchema(config, schema, []);
+        }
+        catch (error) {
+            throw new PluginConfigurationError(`Configuration validation failed for plugin '${pluginName}': ${error instanceof Error ? error.message : String(error)}`, pluginName, undefined, { config, schema, validationError: error });
+        }
+    }
+    addConfigurationEntry(pluginName, entry) {
+        if (!this.configurations.has(pluginName)) {
+            this.configurations.set(pluginName, []);
+        }
+        const entries = this.configurations.get(pluginName);
+        entries.push(entry);
+        entries.sort((a, b) => b.priority - a.priority);
+        this.logger.debug('Configuration entry added', {
+            pluginName,
+            source: entry.source,
+            priority: entry.priority,
+            operation: 'config_entry_added',
+        });
+    }
+    getConfigurationEntries(pluginName) {
+        return this.configurations.get(pluginName) || [];
+    }
+    clearCache() {
+        this.configurations.clear();
+        this.environmentConfigs.clear();
+        this.logger.debug('Configuration cache cleared', {
+            operation: 'config_cache_cleared',
+        });
+    }
+    async loadFileConfiguration(_pluginName, _environment) {
+        return undefined;
+    }
+    loadEnvironmentVariableConfiguration(pluginName) {
+        if (!pluginName) {
+            return undefined;
+        }
+        const prefix = `${this.options.environmentPrefix}_${pluginName.toUpperCase().replace(/[^A-Z0-9]/g, '_')}`;
+        const config = Object.create(null);
+        let hasConfig = false;
+        for (const [key, value] of Object.entries(process.env)) {
+            if (key.startsWith(prefix + '_')) {
+                const configKey = key.substring(prefix.length + 1).toLowerCase();
+                config[configKey] = this.parseEnvironmentValue(value);
+                hasConfig = true;
+            }
+        }
+        return hasConfig ? config : undefined;
+    }
+    async loadEnvironmentFromFiles(_environment) {
+        return undefined;
+    }
+    mergeConfigurations(entries) {
+        const sortedEntries = [...entries].sort((a, b) => a.priority - b.priority);
+        let merged = {};
+        for (const entry of sortedEntries) {
+            if (entry.value && typeof entry.value === 'object' && !Array.isArray(entry.value)) {
+                merged = { ...merged, ...entry.value };
+            }
+        }
+        return merged;
+    }
+    parseEnvironmentValue(value) {
+        if (!value)
+            return undefined;
+        try {
+            return JSON.parse(value);
+        }
+        catch {
+            return value;
+        }
+    }
+    validateAgainstSchema(config, schema, path) {
+        this.validateBasicType(config, schema, path);
+        this.validateObjectProperties(config, schema, path);
+    }
+    validateBasicType(config, schema, path) {
+        if (schema.type) {
+            const actualType = Array.isArray(config) ? 'array' : typeof config;
+            if (actualType !== schema.type) {
+                throw new Error(`Expected ${schema.type} at ${path.join('.')}, got ${actualType}`);
+            }
+        }
+    }
+    validateObjectProperties(config, schema, path) {
+        if (schema.type === 'object' &&
+            schema.properties &&
+            typeof config === 'object' &&
+            config !== null) {
+            const configObj = config;
+            this.validateRequiredProperties(configObj, schema, path);
+            this.validateEachProperty(configObj, schema, path);
+        }
+    }
+    validateRequiredProperties(configObj, schema, path) {
+        if (schema.required) {
+            for (const requiredProp of schema.required) {
+                if (!(requiredProp in configObj)) {
+                    throw new Error(`Missing required property '${requiredProp}' at ${path.join('.')}`);
+                }
+            }
+        }
+    }
+    validateEachProperty(configObj, schema, path) {
+        for (const [propName, propValue] of Object.entries(configObj)) {
+            const propSchema = schema.properties?.[propName];
+            if (propSchema) {
+                this.validateAgainstSchema(propValue, propSchema, [...path, propName]);
+            }
+            else if (!this.options.allowUnknownProperties && !schema.additionalProperties) {
+                throw new Error(`Unknown property '${propName}' at ${path.join('.')}`);
+            }
+        }
+    }
+}