@burojs/config 0.4.0 → 0.5.0

package/README.md

@@ -3,10 +3,13 @@
 Inert JSON and YAML declaration sources for [buro](https://github.com/buro/buro).
 
 Parses a raw JSON or YAML string against a host-owned `SourcePolicy` and
-produces a portable declaration layer — or a list of diagnostics if the
-source is malformed, oversized, or requests something its policy doesn't
-allow. The output can only ever be data: no functions, components, schemas,
-credentials, or provider/action/mapper bindings survive the parse.
+produces a portable declaration layer that carries the policy's grants — or a
+list of diagnostics if the source is malformed, oversized, or requests
+something its policy doesn't allow. *Source* here is a configuration source — a
+JSON or YAML document a host loads into a layer runtime — not a screen's `with`
+source. The output can only ever be data: no
+functions, components, schemas, credentials, or provider/action/mapper bindings
+survive the parse.
 
 ## Install
 
@@ -20,12 +23,24 @@ pnpm add @burojs/config
 import { parseJsonLayer, type SourcePolicy } from '@burojs/config';
 
 const policy: SourcePolicy = {
-  allowedKinds: ['resource'],
-  allowedNamespaces: ['crm'],
-  allowedTransformOps: [],
-  maxTransformScope: 'layer',
+  grants: {
+    allowedKinds: ['resource'],
+    allowedNamespaces: ['crm'],
+    allowedTransformOps: [],
+    maxTransformScope: 'layer',
+    writePaths: {},
+    allowedResources: [],
+    allowedQueries: [],
+    allowedFlows: [],
+    allowedBackends: ['company'],
+    allowedBlocks: [],
+    allowedFrames: [],
+    allowedInlineFlows: [],
+    allowedFieldImplementations: [],
+    priority: { min: 0, max: 0 },
+  },
   allowedCapabilities: {},
-  limits: { maxBytes: 16_000, maxDeclarations: 12, maxDepth: 16, maxStringLength: 1_000, maxDiagnostics: 8 },
+  limits: { maxBytes: 16_000, maxDeclarations: 12, maxDepth: 16, maxNodes: 1_000, maxStringLength: 1_000, maxDiagnostics: 8 },
 };
 
 const source = JSON.stringify({
@@ -34,25 +49,45 @@ const source = JSON.stringify({
   defaultNamespace: 'crm',
   revision: 'r1',
   declarations: [
-    { kind: 'resource', ref: 'company', schemaVersion: 1, value: { name: 'company' } },
+    { kind: 'resource', ref: 'company', schemaVersion: 2, value: { name: 'company' } },
   ],
 });
 
 const result = parseJsonLayer(source, policy);
 if (!result.ok) throw new Error(result.diagnostics.map((d) => d.code).join(', '));
-// result.value is a LayerInput, ready for runtime.publishLayer(...)
+// result.value is a ParsedLayer carrying the grants of `policy`:
+await runtime.publishLayer(result.value);
 ```
 
-To load a source lazily instead of publishing it up front, wrap the parser in
-`createConfigRuntimeSource` and hand the result to a core `LayerRuntime` via
-`registerSource`/`loadSource`.
+To load a source lazily instead of publishing it up front, give
+`createConfigRuntimeSource` the policy and a `load` that returns the document's
+text; it parses each load under the policy, and returns the runtime source with
+the trust to register it under:
+
+```ts
+const configured = createConfigRuntimeSource('catalog', {
+  policy,
+  load: async () => ({ format: 'json', text: await fetch('/config/catalog.json').then((r) => r.text()) }),
+});
+runtime.registerSource(configured.source, configured.trust);
+```
+
+The parser checks keys (it refuses `action`, `component`, `validator` and the
+other code-bearing keys), the trusted-attachment capabilities in
+`allowedCapabilities`, and the `limits`; those checks are parser-only. The
+compiler enforces the `grants` — the kinds, namespaces and transform operations
+a layer uses, the paths a transform may write (`writePaths`, no default), its
+targets, its references (`allowedResources`, `allowedQueries`,
+`allowedFlows`), its backend bindings (`allowedBackends`) and its priority
+band. Use a band strictly away from your code's priorities to fix whether a
+parsed layer applies before or after your code. See the "Grants and trust"
+section of the guide linked below.
 
 ## Main exports
 
 - **`parseJsonLayer` / `parseYamlLayer`** — parse a source string against a `SourcePolicy`, returning a `ParseResult`.
-- **`createConfigRuntimeSource`** — builds a core `RuntimeSource` that fetches, parses, and adapts a source on demand.
-- **`adaptRawConfig` / `parseResultAdapter`** — the pure adapter boundary between a raw source shape and the layer the runtime commits.
-- **`SourcePolicy` / `SourceLimits`** — the allow-list and resource limits a host defines for one untrusted source.
+- **`createConfigRuntimeSource(id, { policy, load })`** — returns `{ source, trust }`: a core `RuntimeSource` that loads and parses a document on demand, and the policy's grants to register it with.
+- **`SourcePolicy` / `SourceLimits`** — `{ grants, allowedCapabilities, limits }`, what a host allows one untrusted source: `grants` (the core `LayerGrants`) is what its parsed layers carry; `SCREEN_SOURCE_LIMITS` is a preset for sources that carry whole screen trees.
 
 See [`docs/raw-config-manifests.md`](../../docs/raw-config-manifests.md) for the full source-policy boundary and how it composes with a `LayerRuntime`.
 

package/dist/index.cjs

@@ -1,31 +1,19 @@
 Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
+let _burojs_core = require("@burojs/core");
+let _burojs_core_internal = require("@burojs/core/internal");
 let yaml = require("yaml");
+//#region src/source-policy.ts
+const MAX_SOURCE_DEPTH = _burojs_core.DEFAULT_COMPILER_LIMITS.maxPortableDepth;
+const SCREEN_SOURCE_LIMITS = Object.freeze({
+	maxBytes: 256e3,
+	maxDeclarations: 64,
+	maxDepth: MAX_SOURCE_DEPTH,
+	maxNodes: 5e3,
+	maxStringLength: 4096,
+	maxDiagnostics: 32
+});
+//#endregion
 //#region src/parse.ts
-const RESERVED_KEYS = new Set([
-	"__proto__",
-	"prototype",
-	"constructor"
-]);
-const FORBIDDEN_VALUE_CATEGORIES = new Map([
-	["action", "action"],
-	["actions", "action"],
-	["provider", "provider"],
-	["providers", "provider"],
-	["mapper", "mapper"],
-	["mappers", "mapper"],
-	["service", "service"],
-	["services", "service"],
-	["credential", "credential"],
-	["credentials", "credential"],
-	["schema", "schema"],
-	["schemas", "schema"],
-	["component", "component"],
-	["components", "component"],
-	["attachment", "attachment"],
-	["attachments", "attachment"],
-	["validator", "validator"],
-	["validators", "validator"]
-]);
 const LAYER_KEYS = new Set([
 	"id",
 	"priority",
@@ -96,6 +84,7 @@ function messageFor(code) {
 		case "source.byte-limit": return "The source exceeds its byte limit.";
 		case "source.declaration-limit": return "The source exceeds its declaration limit.";
 		case "source.depth-limit": return "The source exceeds its nesting-depth limit.";
+		case "source.node-limit": return "The source exceeds its value-count limit.";
 		case "source.string-limit": return "The source contains an overlong string.";
 		case "source.diagnostic-limit": return "Additional source diagnostics were omitted.";
 		case "source.unknown-key": return "The source contains an unknown key.";
@@ -110,7 +99,7 @@ function messageFor(code) {
 		case "source.forbidden-transform-op": return "The source requests a forbidden transform operation.";
 		case "source.forbidden-transform-scope": return "The source requests a forbidden transform scope.";
 		case "source.forbidden-capability": return "The source requests a forbidden capability.";
-		case "source.forbidden-action": return "The source requests a forbidden action binding.";
+		case "source.forbidden-action": return "The source requests a forbidden action binding; a resource's flows are written under toolbar.";
 		case "source.forbidden-provider": return "The source requests a forbidden provider binding.";
 		case "source.forbidden-mapper": return "The source requests a forbidden mapper binding.";
 		case "source.forbidden-service": return "The source requests a forbidden service value.";
@@ -122,14 +111,68 @@ function messageFor(code) {
 		default: return "The source is invalid.";
 	}
 }
+const LIMIT_KEYS = [
+	"maxBytes",
+	"maxDeclarations",
+	"maxDepth",
+	"maxNodes",
+	"maxStringLength",
+	"maxDiagnostics"
+];
+const LIMIT_KEY_SET = new Set(LIMIT_KEYS);
 function validLimits(limits) {
-	return Object.values(limits).every((value) => Number.isSafeInteger(value) && value > 0);
+	return plainObject(limits) && Object.keys(limits).every((key) => LIMIT_KEY_SET.has(key)) && LIMIT_KEYS.every((key) => Number.isSafeInteger(limits[key]) && limits[key] > 0);
 }
 function validCapabilities(value) {
 	return value !== null && typeof value === "object" && !Array.isArray(value) && Object.values(value).every((capabilities) => Array.isArray(capabilities) && capabilities.every((capability) => typeof capability === "string"));
 }
-function validPolicy(policy) {
-	return policy !== null && typeof policy === "object" && Array.isArray(policy.allowedKinds) && Array.isArray(policy.allowedNamespaces) && Array.isArray(policy.allowedTransformOps) && (policy.maxTransformScope === "layer" || policy.maxTransformScope === "namespace" || policy.maxTransformScope === "application") && validCapabilities(policy.allowedCapabilities) && validLimits(policy.limits);
+function grantsError(policy) {
+	try {
+		(0, _burojs_core.normalizeLayerGrants)(policy.grants);
+		return;
+	} catch (error) {
+		return error instanceof TypeError ? error.message : "";
+	}
+}
+function policyDiagnostic(policy) {
+	const generic = messageFor("source.invalid-policy");
+	const stray = strayPolicyKey(policy);
+	if (stray !== void 0) return Object.freeze({
+		code: "source.invalid-policy",
+		message: `The source policy is invalid: it carries ${stray} at the top level; a policy is { grants, allowedCapabilities, limits }, with every grant field inside grants.`
+	});
+	if (!validPolicyShape(policy)) return Object.freeze({
+		code: "source.invalid-policy",
+		message: generic
+	});
+	const reason = grantsError(policy);
+	if (reason === void 0) return void 0;
+	return Object.freeze({
+		code: "source.invalid-policy",
+		message: reason === "" ? generic : `The source policy is invalid: ${reason}`
+	});
+}
+const POLICY_KEYS = new Set([
+	"grants",
+	"allowedCapabilities",
+	"limits"
+]);
+function strayPolicyKey(policy) {
+	return plainObject(policy) ? Object.keys(policy).find((key) => !POLICY_KEYS.has(key)) : void 0;
+}
+function validPolicyShape(policy) {
+	return plainObject(policy) && plainObject(policy.grants) && validCapabilities(policy.allowedCapabilities) && validLimits(policy.limits);
+}
+function ownedPolicy(policy) {
+	const invalid = policyDiagnostic(policy);
+	if (invalid !== void 0) throw new TypeError(invalid.message);
+	const capabilities = Object.create(null);
+	for (const [kind, values] of Object.entries(policy.allowedCapabilities)) capabilities[kind] = Object.freeze([...values]);
+	return Object.freeze({
+		grants: (0, _burojs_core.normalizeLayerGrants)(policy.grants),
+		allowedCapabilities: Object.freeze(capabilities),
+		limits: Object.freeze({ ...policy.limits })
+	});
 }
 function failure(diagnostics) {
 	return {
@@ -150,10 +193,37 @@ function hasData(value, key) {
 	const descriptor = Object.getOwnPropertyDescriptor(value, key);
 	return descriptor !== void 0 && "value" in descriptor;
 }
+const MAX_ENVELOPE_DEPTH = 8;
+function childRole(role, key) {
+	switch (role) {
+		case "root": return key === "declarations" ? "declarations" : key === "transforms" ? "transforms" : "envelope";
+		case "declarations": return "declaration";
+		case "transforms": return "transform";
+		case "declaration": return key === "value" ? "value" : "envelope";
+		case "transform": return key === "operation" ? "operation" : "envelope";
+		case "operation": return key === "value" ? "value" : "envelope";
+		default: return role;
+	}
+}
 function clonePortable(value, limits, diagnostics) {
 	const ancestors = new WeakSet();
-	function copy(current, depth) {
-		if (depth > limits.maxDepth) {
+	const maxDepth = Math.min(limits.maxDepth, MAX_SOURCE_DEPTH);
+	let nodes = 0;
+	let nodesExceeded = false;
+	function overNodeBudget(children) {
+		if (children <= limits.maxNodes - nodes) return false;
+		if (!nodesExceeded) diagnostics.add("source.node-limit");
+		nodesExceeded = true;
+		return true;
+	}
+	function copy(current, depth, role) {
+		nodes += 1;
+		if (nodes > limits.maxNodes) {
+			if (!nodesExceeded) diagnostics.add("source.node-limit");
+			nodesExceeded = true;
+			return null;
+		}
+		if (depth > (role === "value" ? maxDepth : MAX_ENVELOPE_DEPTH)) {
 			diagnostics.add("source.depth-limit");
 			return null;
 		}
@@ -173,6 +243,12 @@ function clonePortable(value, limits, diagnostics) {
 		ancestors.add(current);
 		if (Array.isArray(current)) {
 			const output = [];
+			const length = ownData(current, "length");
+			const arrayLength = typeof length === "number" && Number.isSafeInteger(length) && length >= 0 ? length : void 0;
+			if (arrayLength !== void 0 && overNodeBudget(arrayLength)) {
+				ancestors.delete(current);
+				return null;
+			}
 			for (const key of Reflect.ownKeys(current)) {
 				if (typeof key !== "string" || key !== "length" && !/^(0|[1-9]\d*)$/u.test(key)) {
 					diagnostics.add("source.invalid-layer");
@@ -181,41 +257,47 @@ function clonePortable(value, limits, diagnostics) {
 				if (key === "length") continue;
 				if (!hasData(current, key)) diagnostics.add("source.accessor");
 			}
-			const length = ownData(current, "length");
-			const arrayLength = typeof length === "number" && Number.isSafeInteger(length) && length >= 0 ? length : void 0;
 			if (arrayLength === void 0) diagnostics.add("source.invalid-layer");
-			else for (let index = 0; index < arrayLength; index += 1) {
+			else for (let index = 0; index < arrayLength && !nodesExceeded; index += 1) {
 				if (!hasData(current, String(index))) diagnostics.add("source.accessor");
-				output.push(copy(ownData(current, String(index)), depth + 1));
+				output.push(copy(ownData(current, String(index)), depth + 1, childRole(role, void 0)));
 			}
 			ancestors.delete(current);
 			return Object.freeze(output);
 		}
 		if (!plainObject(current)) diagnostics.add("source.invalid-layer");
 		const output = Object.create(null);
-		for (const key of Reflect.ownKeys(current)) {
+		const keys = Reflect.ownKeys(current);
+		if (overNodeBudget(keys.length)) {
+			ancestors.delete(current);
+			return null;
+		}
+		for (const key of keys) {
+			if (nodesExceeded) break;
 			if (typeof key !== "string") {
 				diagnostics.add("source.invalid-layer");
 				continue;
 			}
-			if (RESERVED_KEYS.has(key)) diagnostics.add("source.reserved-key");
+			if ((0, _burojs_core_internal.isReservedSegment)(key)) diagnostics.add("source.reserved-key");
 			if ([...key].length > limits.maxStringLength) diagnostics.add("source.string-limit");
 			if (!hasData(current, key)) {
 				diagnostics.add("source.accessor");
 				continue;
 			}
-			output[key] = copy(ownData(current, key), depth + 1);
+			const next = childRole(role, key);
+			const nextDepth = next === "value" && role !== "value" ? 0 : depth + 1;
+			output[key] = copy(ownData(current, key), nextDepth, next);
 		}
 		ancestors.delete(current);
 		return Object.freeze(output);
 	}
-	return copy(value, 0);
+	return copy(value, 0, "root");
 }
 function unknownKeys(value, allowed, diagnostics) {
 	for (const key of Object.keys(value)) if (!allowed.has(key)) diagnostics.add("source.unknown-key");
 }
 function allowedNamespace(value, policy, diagnostics) {
-	if (typeof value !== "string" || !policy.allowedNamespaces.includes(value)) {
+	if (typeof value !== "string" || !policy.grants.allowedNamespaces.includes(value)) {
 		diagnostics.add("source.forbidden-namespace");
 		return false;
 	}
@@ -244,17 +326,15 @@ function validateValue(value, kind, policy, diagnostics) {
 	if (!plainObject(value)) return;
 	if (value.$buro === ATTACHMENT_TAG) {
 		const capability = ownData(value, "capability");
-		if (typeof capability !== "string" || !policy.allowedCapabilities[kind]?.includes(capability)) diagnostics.add("source.forbidden-capability");
+		const allowed = Object.hasOwn(policy.allowedCapabilities, kind) ? policy.allowedCapabilities[kind] : void 0;
+		if (typeof capability !== "string" || !allowed?.includes(capability)) diagnostics.add("source.forbidden-capability");
 	}
 	for (const key of Object.keys(value)) {
-		const category = FORBIDDEN_VALUE_CATEGORIES.get(key);
+		const category = (0, _burojs_core_internal.blacklistedKeyCategory)(key);
 		if (category !== void 0) diagnostics.add(`source.forbidden-${category}`);
 		validateValue(ownData(value, key), kind, policy, diagnostics);
 	}
 }
-function scopeRank(scope) {
-	return scope === "layer" ? 0 : scope === "namespace" ? 1 : 2;
-}
 function transformOperation(value) {
 	if (!plainObject(value)) return void 0;
 	const operation = ownData(value, "op");
@@ -285,7 +365,7 @@ function validateTransforms(value, defaultNamespace, policy, diagnostics) {
 		unknownKeys(transform, TRANSFORM_KEYS, diagnostics);
 		const scope = ownData(transform, "scope") ?? "layer";
 		if (scope !== "layer" && scope !== "application") diagnostics.add("source.invalid-transform");
-		else if (scopeRank(scope) > scopeRank(policy.maxTransformScope)) diagnostics.add("source.forbidden-transform-scope");
+		else if ((0, _burojs_core_internal.scopeRank)(scope) > (0, _burojs_core_internal.scopeRank)(policy.grants.maxTransformScope)) diagnostics.add("source.forbidden-transform-scope");
 		const select = ownData(transform, "select");
 		if (!plainObject(select)) diagnostics.add("source.invalid-transform");
 		else {
@@ -294,7 +374,7 @@ function validateTransforms(value, defaultNamespace, policy, diagnostics) {
 			if (selectedKinds !== void 0) {
 				if (!Array.isArray(selectedKinds)) diagnostics.add("source.invalid-transform");
 				else for (const kind of selectedKinds) if (typeof kind !== "string") diagnostics.add("source.invalid-transform");
-				else if (!policy.allowedKinds.includes(kind)) diagnostics.add("source.forbidden-kind");
+				else if (!policy.grants.allowedKinds.includes(kind)) diagnostics.add("source.forbidden-kind");
 			}
 			const selectedNamespaces = ownData(select, "namespaces");
 			if (selectedNamespaces !== void 0) {
@@ -309,7 +389,7 @@ function validateTransforms(value, defaultNamespace, policy, diagnostics) {
 		if (typeof (plainObject(operation) ? ownData(operation, "op") : void 0) === "string" && op === void 0) diagnostics.add("source.forbidden-transform-op");
 		else if (op === void 0) diagnostics.add("source.invalid-transform");
 		else {
-			if (!policy.allowedTransformOps.includes(op)) diagnostics.add("source.forbidden-transform-op");
+			if (!policy.grants.allowedTransformOps.includes(op)) diagnostics.add("source.forbidden-transform-op");
 			if (plainObject(operation)) {
 				unknownKeys(operation, OPERATION_KEYS[op], diagnostics);
 				if (hasData(operation, "value")) validateValue(ownData(operation, "value"), "", policy, diagnostics);
@@ -318,12 +398,10 @@ function validateTransforms(value, defaultNamespace, policy, diagnostics) {
 	}
 }
 function validateLayerValue(value, policy) {
-	if (!validPolicy(policy)) return {
+	const invalidPolicy = policyDiagnostic(policy);
+	if (invalidPolicy !== void 0) return {
 		ok: false,
-		diagnostics: Object.freeze([Object.freeze({
-			code: "source.invalid-policy",
-			message: messageFor("source.invalid-policy")
-		})])
+		diagnostics: Object.freeze([invalidPolicy])
 	};
 	const diagnostics = new Diagnostics(policy.limits.maxDiagnostics);
 	const cloned = clonePortable(value, policy.limits, diagnostics);
@@ -353,7 +431,7 @@ function validateLayerValue(value, policy) {
 		unknownKeys(declaration, DECLARATION_KEYS, diagnostics);
 		const kind = ownData(declaration, "kind");
 		if (typeof kind !== "string") diagnostics.add("source.invalid-declaration");
-		else if (!policy.allowedKinds.includes(kind)) diagnostics.add("source.forbidden-kind");
+		else if (!policy.grants.allowedKinds.includes(kind)) diagnostics.add("source.forbidden-kind");
 		const namespace = namespaceFor(ownData(declaration, "ref"), typeof defaultNamespace === "string" ? defaultNamespace : "default", diagnostics);
 		if (namespace !== void 0) allowedNamespace(namespace, policy, diagnostics);
 		if (!Number.isSafeInteger(ownData(declaration, "schemaVersion")) || !hasData(declaration, "value")) diagnostics.add("source.invalid-declaration");
@@ -363,14 +441,14 @@ function validateLayerValue(value, policy) {
 	if (diagnostics.values.length > 0) return failure(diagnostics);
 	return {
 		ok: true,
-		value: cloned
+		value: (0, _burojs_core_internal.createParsedLayer)(cloned, (0, _burojs_core.normalizeLayerGrants)(policy.grants))
 	};
 }
 function byteLength(value) {
 	return new TextEncoder().encode(value).byteLength;
 }
 function parseSource(source, policy, format) {
-	if (!validPolicy(policy)) return validateLayerValue(null, policy);
+	if (policyDiagnostic(policy) !== void 0) return validateLayerValue(null, policy);
 	const diagnostics = new Diagnostics(policy.limits.maxDiagnostics);
 	if (byteLength(source) > policy.limits.maxBytes) {
 		diagnostics.add("source.byte-limit");
@@ -400,82 +478,12 @@ function parseYamlLayer(source, policy) {
 	return parseSource(source, policy, "yaml");
 }
 //#endregion
-//#region src/adapter.ts
-function diagnostic(code, message) {
-	return Object.freeze({
-		code,
-		message
-	});
-}
-function diagnosticLimit(policy) {
-	const candidate = policy?.limits?.maxDiagnostics;
-	return typeof candidate === "number" && Number.isSafeInteger(candidate) && candidate > 0 ? candidate : 1;
-}
-function frozenPolicy(policy) {
-	const capabilities = Object.create(null);
-	for (const [kind, values] of Object.entries(policy.allowedCapabilities)) capabilities[kind] = Object.freeze([...values]);
-	const limits = Object.freeze({ ...policy.limits });
-	return Object.freeze({
-		allowedKinds: Object.freeze([...policy.allowedKinds]),
-		allowedNamespaces: Object.freeze([...policy.allowedNamespaces]),
-		allowedTransformOps: Object.freeze([...policy.allowedTransformOps]),
-		maxTransformScope: policy.maxTransformScope,
-		allowedCapabilities: Object.freeze(capabilities),
-		limits
-	});
-}
-function copyDiagnostic(value) {
-	if (value !== null && typeof value === "object" && typeof value.code === "string" && typeof value.message === "string") return diagnostic(value.code, value.message);
-	return diagnostic("source.invalid-adapter-diagnostic", "The source adapter returned an invalid diagnostic.");
-}
-function adaptRawConfig(input, adapter, policy) {
-	const policyValidation = validateLayerValue(null, policy);
-	if (!policyValidation.ok && policyValidation.diagnostics.some((entry) => entry.code === "source.invalid-policy")) return policyValidation;
-	const ownedPolicy = frozenPolicy(policy);
-	const diagnostics = [];
-	const maxDiagnostics = diagnosticLimit(ownedPolicy);
-	let limited = false;
-	const add = (value) => {
-		if (limited) return;
-		if (diagnostics.length + 1 < maxDiagnostics) {
-			diagnostics.push(value);
-			return;
-		}
-		limited = true;
-		diagnostics.push(diagnostic("source.diagnostic-limit", "Additional source diagnostics were omitted."));
-	};
-	const context = Object.freeze({
-		policy: ownedPolicy,
-		limits: ownedPolicy.limits,
-		diagnose(code, message) {
-			add(copyDiagnostic({
-				code,
-				message
-			}));
-		}
-	});
-	const result = adapter.adapt(input, context);
-	if (result === null || typeof result !== "object") add(diagnostic("source.invalid-adapter-result", "The source adapter returned an invalid result."));
-	else if (result.diagnostics !== void 0) {
-		if (!Array.isArray(result.diagnostics)) add(diagnostic("source.invalid-adapter-result", "The source adapter returned an invalid result."));
-		else for (const entry of result.diagnostics) add(copyDiagnostic(entry));
-	}
-	if (diagnostics.length > 0) return {
-		ok: false,
-		diagnostics: Object.freeze(diagnostics)
-	};
-	if (result === null || typeof result !== "object" || result.layer === void 0) return {
-		ok: false,
-		diagnostics: Object.freeze([diagnostic("source.invalid-adapter-result", "The source adapter did not return a declaration layer.")])
-	};
-	return validateLayerValue(result.layer, ownedPolicy);
-}
-const parseResultAdapter = Object.freeze({ adapt(input) {
-	return input.ok ? { layer: input.value } : { diagnostics: input.diagnostics };
-} });
-//#endregion
 //#region src/runtime-source.ts
-function adaptationFailure(diagnostics) {
+const INVALID_FORMAT = Object.freeze({
+	code: "source.invalid-format",
+	message: "The source format must be json or yaml."
+});
+function rejection(diagnostics) {
 	return Object.freeze({
 		status: "rejected",
 		diagnostics: Object.freeze(diagnostics.map((entry) => Object.freeze({
@@ -484,21 +492,28 @@ function adaptationFailure(diagnostics) {
 		})))
 	});
 }
-function createConfigRuntimeSource(id, fetchRaw, adapter, policy) {
-	return Object.freeze({
+function createConfigRuntimeSource(id, options) {
+	const policy = ownedPolicy(options.policy);
+	const { load } = options;
+	const source = Object.freeze({
 		id,
 		async load(context) {
-			const adapted = adaptRawConfig(await fetchRaw(context), adapter, policy);
-			if (!adapted.ok) return adaptationFailure(adapted.diagnostics);
-			return adapted.value;
+			const raw = await load(context);
+			const parsed = raw.format === "json" ? parseJsonLayer(raw.text, policy) : raw.format === "yaml" ? parseYamlLayer(raw.text, policy) : void 0;
+			if (parsed === void 0) return rejection([INVALID_FORMAT]);
+			return parsed.ok ? parsed.value : rejection(parsed.diagnostics);
 		}
 	});
+	return Object.freeze({
+		source,
+		trust: policy.grants
+	});
 }
 //#endregion
-exports.adaptRawConfig = adaptRawConfig;
+exports.MAX_SOURCE_DEPTH = MAX_SOURCE_DEPTH;
+exports.SCREEN_SOURCE_LIMITS = SCREEN_SOURCE_LIMITS;
 exports.createConfigRuntimeSource = createConfigRuntimeSource;
 exports.parseJsonLayer = parseJsonLayer;
-exports.parseResultAdapter = parseResultAdapter;
 exports.parseYamlLayer = parseYamlLayer;
 
 //# sourceMappingURL=index.cjs.map