@burojs/config 0.2.0

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 Maksim Kuznetsov
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -0,0 +1,61 @@
+# @burojs/config
+
+Inert JSON and YAML declaration sources for [buro](https://github.com/buro/buro).
+
+Parses a raw JSON or YAML string against a host-owned `SourcePolicy` and
+produces a portable declaration layer — or a list of diagnostics if the
+source is malformed, oversized, or requests something its policy doesn't
+allow. The output can only ever be data: no functions, components, schemas,
+credentials, or provider/action/mapper bindings survive the parse.
+
+## Install
+
+```bash
+pnpm add @burojs/config
+```
+
+## Usage
+
+```ts
+import { parseJsonLayer, type SourcePolicy } from '@burojs/config';
+
+const policy: SourcePolicy = {
+  allowedKinds: ['resource'],
+  allowedNamespaces: ['crm'],
+  allowedTransformOps: [],
+  maxTransformScope: 'layer',
+  allowedCapabilities: {},
+  limits: { maxBytes: 16_000, maxDeclarations: 12, maxDepth: 16, maxStringLength: 1_000, maxDiagnostics: 8 },
+};
+
+const source = JSON.stringify({
+  id: 'static-catalog',
+  priority: 0,
+  defaultNamespace: 'crm',
+  revision: 'r1',
+  declarations: [
+    { kind: 'resource', ref: 'company', schemaVersion: 1, value: { name: 'company' } },
+  ],
+});
+
+const result = parseJsonLayer(source, policy);
+if (!result.ok) throw new Error(result.diagnostics.map((d) => d.code).join(', '));
+// result.value is a LayerInput, ready for runtime.publishLayer(...)
+```
+
+To load a source lazily instead of publishing it up front, wrap the parser in
+`createConfigRuntimeSource` and hand the result to a core `LayerRuntime` via
+`registerSource`/`loadSource`.
+
+## Main exports
+
+- **`parseJsonLayer` / `parseYamlLayer`** — parse a source string against a `SourcePolicy`, returning a `ParseResult`.
+- **`createConfigRuntimeSource`** — builds a core `RuntimeSource` that fetches, parses, and adapts a source on demand.
+- **`adaptRawConfig` / `parseResultAdapter`** — the pure adapter boundary between a raw source shape and the layer the runtime commits.
+- **`SourcePolicy` / `SourceLimits`** — the allow-list and resource limits a host defines for one untrusted source.
+
+See [`docs/raw-config-manifests.md`](../../docs/raw-config-manifests.md) for the full source-policy boundary and how it composes with a `LayerRuntime`.
+
+## License
+
+MIT

package/dist/index.cjs

@@ -0,0 +1,563 @@
+'use strict';
+
+var yaml = require('yaml');
+
+// src/parse.ts
+var RESERVED_KEYS = /* @__PURE__ */ new Set(["__proto__", "prototype", "constructor"]);
+var FORBIDDEN_VALUE_CATEGORIES = /* @__PURE__ */ new Map([
+  ["action", "action"],
+  ["actions", "action"],
+  ["provider", "provider"],
+  ["providers", "provider"],
+  ["mapper", "mapper"],
+  ["mappers", "mapper"],
+  ["service", "service"],
+  ["services", "service"],
+  ["credential", "credential"],
+  ["credentials", "credential"],
+  ["schema", "schema"],
+  ["schemas", "schema"],
+  ["component", "component"],
+  ["components", "component"],
+  ["attachment", "attachment"],
+  ["attachments", "attachment"],
+  ["validator", "validator"],
+  ["validators", "validator"]
+]);
+var LAYER_KEYS = /* @__PURE__ */ new Set([
+  "id",
+  "priority",
+  "defaultNamespace",
+  "revision",
+  "declarations",
+  "transforms"
+]);
+var DECLARATION_KEYS = /* @__PURE__ */ new Set(["kind", "ref", "schemaVersion", "value"]);
+var TRANSFORM_KEYS = /* @__PURE__ */ new Set(["id", "scope", "select", "operation"]);
+var SELECTOR_KEYS = /* @__PURE__ */ new Set(["kinds", "namespaces", "layers", "refs", "excludeRefs", "tags"]);
+var OPERATION_KEYS = {
+  merge: /* @__PURE__ */ new Set(["op", "value"]),
+  replace: /* @__PURE__ */ new Set(["op", "value", "ifMissing"]),
+  disable: /* @__PURE__ */ new Set(["op", "reason"]),
+  delete: /* @__PURE__ */ new Set(["op"])
+};
+var ATTACHMENT_TAG = "@burojs/core/trusted-attachment";
+var Diagnostics = class {
+  constructor(limit) {
+    this.limit = limit;
+  }
+  limit;
+  values = [];
+  limited = false;
+  add(code) {
+    if (this.limited) return;
+    if (this.values.length + 1 < this.limit) {
+      this.values.push(Object.freeze({ code, message: messageFor(code) }));
+      return;
+    }
+    this.limited = true;
+    this.values.push(
+      Object.freeze({
+        code: "source.diagnostic-limit",
+        message: messageFor("source.diagnostic-limit")
+      })
+    );
+  }
+};
+function messageFor(code) {
+  switch (code) {
+    case "source.invalid-json":
+      return "The source is not valid JSON.";
+    case "source.invalid-yaml":
+      return "The source is not valid YAML.";
+    case "source.invalid-policy":
+      return "The source policy is invalid.";
+    case "source.byte-limit":
+      return "The source exceeds its byte limit.";
+    case "source.declaration-limit":
+      return "The source exceeds its declaration limit.";
+    case "source.depth-limit":
+      return "The source exceeds its nesting-depth limit.";
+    case "source.string-limit":
+      return "The source contains an overlong string.";
+    case "source.diagnostic-limit":
+      return "Additional source diagnostics were omitted.";
+    case "source.unknown-key":
+      return "The source contains an unknown key.";
+    case "source.reserved-key":
+      return "The source contains a reserved key.";
+    case "source.accessor":
+      return "The source must use data properties.";
+    case "source.cyclic-value":
+      return "The source must not contain cyclic values.";
+    case "source.invalid-layer":
+      return "The source layer is invalid.";
+    case "source.invalid-declaration":
+      return "The source declaration is invalid.";
+    case "source.invalid-transform":
+      return "The source transform is invalid.";
+    case "source.forbidden-kind":
+      return "The source requests a forbidden declaration kind.";
+    case "source.forbidden-namespace":
+      return "The source requests a forbidden namespace.";
+    case "source.forbidden-transform-op":
+      return "The source requests a forbidden transform operation.";
+    case "source.forbidden-transform-scope":
+      return "The source requests a forbidden transform scope.";
+    case "source.forbidden-capability":
+      return "The source requests a forbidden capability.";
+    case "source.forbidden-action":
+      return "The source requests a forbidden action binding.";
+    case "source.forbidden-provider":
+      return "The source requests a forbidden provider binding.";
+    case "source.forbidden-mapper":
+      return "The source requests a forbidden mapper binding.";
+    case "source.forbidden-service":
+      return "The source requests a forbidden service value.";
+    case "source.forbidden-credential":
+      return "The source requests a forbidden credential value.";
+    case "source.forbidden-schema":
+      return "The source requests a forbidden schema value.";
+    case "source.forbidden-component":
+      return "The source requests a forbidden component value.";
+    case "source.forbidden-attachment":
+      return "The source requests a forbidden attachment value.";
+    case "source.forbidden-validator":
+      return "The source requests a forbidden validator value.";
+    default:
+      return "The source is invalid.";
+  }
+}
+function validLimits(limits) {
+  return Object.values(limits).every((value) => Number.isSafeInteger(value) && value > 0);
+}
+function validCapabilities(value) {
+  return value !== null && typeof value === "object" && !Array.isArray(value) && Object.values(value).every(
+    (capabilities) => Array.isArray(capabilities) && capabilities.every((capability) => typeof capability === "string")
+  );
+}
+function validPolicy(policy) {
+  return policy !== null && typeof policy === "object" && Array.isArray(policy.allowedKinds) && Array.isArray(policy.allowedNamespaces) && Array.isArray(policy.allowedTransformOps) && (policy.maxTransformScope === "layer" || policy.maxTransformScope === "namespace" || policy.maxTransformScope === "application") && validCapabilities(policy.allowedCapabilities) && validLimits(policy.limits);
+}
+function failure(diagnostics) {
+  return { ok: false, diagnostics: Object.freeze(diagnostics.values) };
+}
+function plainObject(value) {
+  if (value === null || typeof value !== "object" || Array.isArray(value)) return false;
+  const prototype = Object.getPrototypeOf(value);
+  return prototype === Object.prototype || prototype === null;
+}
+function ownData(value, key) {
+  const descriptor = Object.getOwnPropertyDescriptor(value, key);
+  return descriptor !== void 0 && "value" in descriptor ? descriptor.value : void 0;
+}
+function hasData(value, key) {
+  const descriptor = Object.getOwnPropertyDescriptor(value, key);
+  return descriptor !== void 0 && "value" in descriptor;
+}
+function clonePortable(value, limits, diagnostics) {
+  const ancestors = /* @__PURE__ */ new WeakSet();
+  function copy(current, depth) {
+    if (depth > limits.maxDepth) {
+      diagnostics.add("source.depth-limit");
+      return null;
+    }
+    if (current === null || typeof current === "boolean" || typeof current === "number")
+      return current;
+    if (typeof current === "string") {
+      if ([...current].length > limits.maxStringLength) diagnostics.add("source.string-limit");
+      return current;
+    }
+    if (typeof current !== "object") {
+      diagnostics.add("source.invalid-layer");
+      return null;
+    }
+    if (ancestors.has(current)) {
+      diagnostics.add("source.cyclic-value");
+      return null;
+    }
+    ancestors.add(current);
+    if (Array.isArray(current)) {
+      const output2 = [];
+      for (const key of Reflect.ownKeys(current)) {
+        if (typeof key !== "string" || key !== "length" && !/^(0|[1-9]\d*)$/u.test(key)) {
+          diagnostics.add("source.invalid-layer");
+          continue;
+        }
+        if (key === "length") continue;
+        if (!hasData(current, key)) diagnostics.add("source.accessor");
+      }
+      const length = ownData(current, "length");
+      const arrayLength = typeof length === "number" && Number.isSafeInteger(length) && length >= 0 ? length : void 0;
+      if (arrayLength === void 0) diagnostics.add("source.invalid-layer");
+      else
+        for (let index = 0; index < arrayLength; index += 1) {
+          if (!hasData(current, String(index))) diagnostics.add("source.accessor");
+          output2.push(copy(ownData(current, String(index)), depth + 1));
+        }
+      ancestors.delete(current);
+      return Object.freeze(output2);
+    }
+    if (!plainObject(current)) diagnostics.add("source.invalid-layer");
+    const output = /* @__PURE__ */ Object.create(null);
+    for (const key of Reflect.ownKeys(current)) {
+      if (typeof key !== "string") {
+        diagnostics.add("source.invalid-layer");
+        continue;
+      }
+      if (RESERVED_KEYS.has(key)) diagnostics.add("source.reserved-key");
+      if ([...key].length > limits.maxStringLength) diagnostics.add("source.string-limit");
+      if (!hasData(current, key)) {
+        diagnostics.add("source.accessor");
+        continue;
+      }
+      output[key] = copy(ownData(current, key), depth + 1);
+    }
+    ancestors.delete(current);
+    return Object.freeze(output);
+  }
+  return copy(value, 0);
+}
+function unknownKeys(value, allowed, diagnostics) {
+  for (const key of Object.keys(value))
+    if (!allowed.has(key)) diagnostics.add("source.unknown-key");
+}
+function allowedNamespace(value, policy, diagnostics) {
+  if (typeof value !== "string" || !policy.allowedNamespaces.includes(value)) {
+    diagnostics.add("source.forbidden-namespace");
+    return false;
+  }
+  return true;
+}
+function namespaceFor(ref, defaultNamespace, diagnostics) {
+  if (typeof ref === "string") {
+    const separator = ref.indexOf(":");
+    return separator === -1 ? defaultNamespace : ref.slice(0, separator);
+  }
+  if (!plainObject(ref) || !hasData(ref, "id")) {
+    diagnostics.add("source.invalid-declaration");
+    return void 0;
+  }
+  for (const key of Object.keys(ref))
+    if (key !== "id" && key !== "namespace") diagnostics.add("source.unknown-key");
+  const namespace = hasData(ref, "namespace") ? ownData(ref, "namespace") : defaultNamespace;
+  if (typeof namespace !== "string") diagnostics.add("source.invalid-declaration");
+  return typeof namespace === "string" ? namespace : void 0;
+}
+function validateValue(value, kind, policy, diagnostics) {
+  if (value === null || typeof value !== "object") return;
+  if (Array.isArray(value)) {
+    for (const item of value) validateValue(item, kind, policy, diagnostics);
+    return;
+  }
+  if (!plainObject(value)) return;
+  if (value.$buro === ATTACHMENT_TAG) {
+    const capability = ownData(value, "capability");
+    if (typeof capability !== "string" || !policy.allowedCapabilities[kind]?.includes(capability)) {
+      diagnostics.add("source.forbidden-capability");
+    }
+  }
+  for (const key of Object.keys(value)) {
+    const category = FORBIDDEN_VALUE_CATEGORIES.get(key);
+    if (category !== void 0) diagnostics.add(`source.forbidden-${category}`);
+    validateValue(ownData(value, key), kind, policy, diagnostics);
+  }
+}
+function scopeRank(scope) {
+  return scope === "layer" ? 0 : scope === "namespace" ? 1 : 2;
+}
+function transformOperation(value) {
+  if (!plainObject(value)) return void 0;
+  const operation = ownData(value, "op");
+  return operation === "merge" || operation === "replace" || operation === "disable" || operation === "delete" ? operation : void 0;
+}
+function validateSelectorRefs(value, defaultNamespace, policy, diagnostics) {
+  if (value === void 0) return;
+  if (!Array.isArray(value)) {
+    diagnostics.add("source.invalid-transform");
+    return;
+  }
+  for (const ref of value) {
+    const namespace = namespaceFor(ref, defaultNamespace, diagnostics);
+    if (namespace !== void 0) allowedNamespace(namespace, policy, diagnostics);
+  }
+}
+function validateTransforms(value, defaultNamespace, policy, diagnostics) {
+  if (value === void 0) return;
+  if (!Array.isArray(value)) {
+    diagnostics.add("source.invalid-transform");
+    return;
+  }
+  for (const transform of value) {
+    if (!plainObject(transform)) {
+      diagnostics.add("source.invalid-transform");
+      continue;
+    }
+    unknownKeys(transform, TRANSFORM_KEYS, diagnostics);
+    const scope = ownData(transform, "scope") ?? "layer";
+    if (scope !== "layer" && scope !== "application") diagnostics.add("source.invalid-transform");
+    else if (scopeRank(scope) > scopeRank(policy.maxTransformScope))
+      diagnostics.add("source.forbidden-transform-scope");
+    const select = ownData(transform, "select");
+    if (!plainObject(select)) diagnostics.add("source.invalid-transform");
+    else {
+      unknownKeys(select, SELECTOR_KEYS, diagnostics);
+      const selectedKinds = ownData(select, "kinds");
+      if (selectedKinds !== void 0) {
+        if (!Array.isArray(selectedKinds)) diagnostics.add("source.invalid-transform");
+        else
+          for (const kind of selectedKinds) {
+            if (typeof kind !== "string") diagnostics.add("source.invalid-transform");
+            else if (!policy.allowedKinds.includes(kind)) diagnostics.add("source.forbidden-kind");
+          }
+      }
+      const selectedNamespaces = ownData(select, "namespaces");
+      if (selectedNamespaces !== void 0) {
+        if (!Array.isArray(selectedNamespaces)) diagnostics.add("source.invalid-transform");
+        else
+          for (const namespace of selectedNamespaces)
+            allowedNamespace(namespace, policy, diagnostics);
+      }
+      validateSelectorRefs(ownData(select, "refs"), defaultNamespace, policy, diagnostics);
+      validateSelectorRefs(ownData(select, "excludeRefs"), defaultNamespace, policy, diagnostics);
+    }
+    const operation = ownData(transform, "operation");
+    const op = transformOperation(operation);
+    const rawOp = plainObject(operation) ? ownData(operation, "op") : void 0;
+    if (typeof rawOp === "string" && op === void 0)
+      diagnostics.add("source.forbidden-transform-op");
+    else if (op === void 0) diagnostics.add("source.invalid-transform");
+    else {
+      if (!policy.allowedTransformOps.includes(op))
+        diagnostics.add("source.forbidden-transform-op");
+      if (plainObject(operation)) {
+        unknownKeys(operation, OPERATION_KEYS[op], diagnostics);
+        if (hasData(operation, "value"))
+          validateValue(ownData(operation, "value"), "", policy, diagnostics);
+      }
+    }
+  }
+}
+function validateLayerValue(value, policy) {
+  if (!validPolicy(policy)) {
+    return {
+      ok: false,
+      diagnostics: Object.freeze([
+        Object.freeze({
+          code: "source.invalid-policy",
+          message: messageFor("source.invalid-policy")
+        })
+      ])
+    };
+  }
+  const diagnostics = new Diagnostics(policy.limits.maxDiagnostics);
+  const cloned = clonePortable(value, policy.limits, diagnostics);
+  if (diagnostics.values.length > 0) return failure(diagnostics);
+  if (!plainObject(cloned)) {
+    diagnostics.add("source.invalid-layer");
+    return failure(diagnostics);
+  }
+  unknownKeys(cloned, LAYER_KEYS, diagnostics);
+  const id = ownData(cloned, "id");
+  const priority = ownData(cloned, "priority");
+  const declarations = ownData(cloned, "declarations");
+  if (typeof id !== "string" || !Number.isSafeInteger(priority) || !Array.isArray(declarations)) {
+    diagnostics.add("source.invalid-layer");
+    return failure(diagnostics);
+  }
+  if (declarations.length > policy.limits.maxDeclarations)
+    diagnostics.add("source.declaration-limit");
+  const rawDefaultNamespace = ownData(cloned, "defaultNamespace");
+  const defaultNamespace = rawDefaultNamespace === void 0 ? "default" : rawDefaultNamespace;
+  if (typeof defaultNamespace !== "string") diagnostics.add("source.invalid-layer");
+  else allowedNamespace(defaultNamespace, policy, diagnostics);
+  for (const declaration of declarations) {
+    if (!plainObject(declaration)) {
+      diagnostics.add("source.invalid-declaration");
+      continue;
+    }
+    unknownKeys(declaration, DECLARATION_KEYS, diagnostics);
+    const kind = ownData(declaration, "kind");
+    if (typeof kind !== "string") diagnostics.add("source.invalid-declaration");
+    else if (!policy.allowedKinds.includes(kind)) diagnostics.add("source.forbidden-kind");
+    const namespace = namespaceFor(
+      ownData(declaration, "ref"),
+      typeof defaultNamespace === "string" ? defaultNamespace : "default",
+      diagnostics
+    );
+    if (namespace !== void 0) allowedNamespace(namespace, policy, diagnostics);
+    if (!Number.isSafeInteger(ownData(declaration, "schemaVersion")) || !hasData(declaration, "value")) {
+      diagnostics.add("source.invalid-declaration");
+    }
+    if (typeof kind === "string" && hasData(declaration, "value")) {
+      validateValue(ownData(declaration, "value"), kind, policy, diagnostics);
+    }
+  }
+  validateTransforms(
+    ownData(cloned, "transforms"),
+    typeof defaultNamespace === "string" ? defaultNamespace : "default",
+    policy,
+    diagnostics
+  );
+  if (diagnostics.values.length > 0) return failure(diagnostics);
+  return { ok: true, value: cloned };
+}
+function byteLength(value) {
+  return new TextEncoder().encode(value).byteLength;
+}
+function parseSource(source, policy, format) {
+  if (!validPolicy(policy)) return validateLayerValue(null, policy);
+  const diagnostics = new Diagnostics(policy.limits.maxDiagnostics);
+  if (byteLength(source) > policy.limits.maxBytes) {
+    diagnostics.add("source.byte-limit");
+    return failure(diagnostics);
+  }
+  try {
+    if (format === "json") return validateLayerValue(JSON.parse(source), policy);
+    const document = yaml.parseDocument(source, { prettyErrors: false, strict: true, uniqueKeys: true });
+    if (document.errors.length > 0) {
+      diagnostics.add("source.invalid-yaml");
+      return failure(diagnostics);
+    }
+    return validateLayerValue(document.toJS({ maxAliasCount: 0 }), policy);
+  } catch {
+    diagnostics.add(format === "json" ? "source.invalid-json" : "source.invalid-yaml");
+    return failure(diagnostics);
+  }
+}
+function parseJsonLayer(source, policy) {
+  return parseSource(source, policy, "json");
+}
+function parseYamlLayer(source, policy) {
+  return parseSource(source, policy, "yaml");
+}
+
+// src/adapter.ts
+function diagnostic(code, message) {
+  return Object.freeze({ code, message });
+}
+function diagnosticLimit(policy) {
+  const candidate = policy?.limits?.maxDiagnostics;
+  return typeof candidate === "number" && Number.isSafeInteger(candidate) && candidate > 0 ? candidate : 1;
+}
+function frozenPolicy(policy) {
+  const capabilities = /* @__PURE__ */ Object.create(null);
+  for (const [kind, values] of Object.entries(policy.allowedCapabilities)) {
+    capabilities[kind] = Object.freeze([...values]);
+  }
+  const limits = Object.freeze({ ...policy.limits });
+  return Object.freeze({
+    allowedKinds: Object.freeze([...policy.allowedKinds]),
+    allowedNamespaces: Object.freeze([...policy.allowedNamespaces]),
+    allowedTransformOps: Object.freeze([...policy.allowedTransformOps]),
+    maxTransformScope: policy.maxTransformScope,
+    allowedCapabilities: Object.freeze(capabilities),
+    limits
+  });
+}
+function copyDiagnostic(value) {
+  if (value !== null && typeof value === "object" && typeof value.code === "string" && typeof value.message === "string") {
+    return diagnostic(
+      value.code,
+      value.message
+    );
+  }
+  return diagnostic(
+    "source.invalid-adapter-diagnostic",
+    "The source adapter returned an invalid diagnostic."
+  );
+}
+function adaptRawConfig(input, adapter, policy) {
+  const policyValidation = validateLayerValue(null, policy);
+  if (!policyValidation.ok && policyValidation.diagnostics.some((entry) => entry.code === "source.invalid-policy")) {
+    return policyValidation;
+  }
+  const ownedPolicy = frozenPolicy(policy);
+  const diagnostics = [];
+  const maxDiagnostics = diagnosticLimit(ownedPolicy);
+  let limited = false;
+  const add = (value) => {
+    if (limited) return;
+    if (diagnostics.length + 1 < maxDiagnostics) {
+      diagnostics.push(value);
+      return;
+    }
+    limited = true;
+    diagnostics.push(
+      diagnostic("source.diagnostic-limit", "Additional source diagnostics were omitted.")
+    );
+  };
+  const context = Object.freeze({
+    policy: ownedPolicy,
+    limits: ownedPolicy.limits,
+    diagnose(code, message) {
+      add(copyDiagnostic({ code, message }));
+    }
+  });
+  const result = adapter.adapt(input, context);
+  if (result === null || typeof result !== "object") {
+    add(
+      diagnostic("source.invalid-adapter-result", "The source adapter returned an invalid result.")
+    );
+  } else if (result.diagnostics !== void 0) {
+    if (!Array.isArray(result.diagnostics)) {
+      add(
+        diagnostic(
+          "source.invalid-adapter-result",
+          "The source adapter returned an invalid result."
+        )
+      );
+    } else {
+      for (const entry of result.diagnostics) add(copyDiagnostic(entry));
+    }
+  }
+  if (diagnostics.length > 0) {
+    return { ok: false, diagnostics: Object.freeze(diagnostics) };
+  }
+  if (result === null || typeof result !== "object" || result.layer === void 0) {
+    return {
+      ok: false,
+      diagnostics: Object.freeze([
+        diagnostic(
+          "source.invalid-adapter-result",
+          "The source adapter did not return a declaration layer."
+        )
+      ])
+    };
+  }
+  return validateLayerValue(result.layer, ownedPolicy);
+}
+var parseResultAdapter = Object.freeze({
+  adapt(input) {
+    return input.ok ? { layer: input.value } : { diagnostics: input.diagnostics };
+  }
+});
+
+// src/runtime-source.ts
+function adaptationFailure(diagnostics) {
+  return Object.freeze({
+    status: "rejected",
+    diagnostics: Object.freeze(
+      diagnostics.map((entry) => Object.freeze({ code: entry.code, message: entry.message }))
+    )
+  });
+}
+function createConfigRuntimeSource(id, fetchRaw, adapter, policy) {
+  return Object.freeze({
+    id,
+    async load(context) {
+      const raw = await fetchRaw(context);
+      const adapted = adaptRawConfig(raw, adapter, policy);
+      if (!adapted.ok) return adaptationFailure(adapted.diagnostics);
+      return adapted.value;
+    }
+  });
+}
+
+exports.adaptRawConfig = adaptRawConfig;
+exports.createConfigRuntimeSource = createConfigRuntimeSource;
+exports.parseJsonLayer = parseJsonLayer;
+exports.parseResultAdapter = parseResultAdapter;
+exports.parseYamlLayer = parseYamlLayer;
+//# sourceMappingURL=index.cjs.map
+//# sourceMappingURL=index.cjs.map