@burojs/config 0.4.0 → 0.5.0

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","names":[],"sources":["../src/parse.ts","../src/adapter.ts","../src/runtime-source.ts"],"sourcesContent":["import type { LayerInput } from '@burojs/core';\nimport { parseDocument } from 'yaml';\nimport type { SourceLimits, SourcePolicy, TransformOp } from './source-policy.js';\n\nconst RESERVED_KEYS = new Set(['__proto__', 'prototype', 'constructor']);\nconst FORBIDDEN_VALUE_CATEGORIES: ReadonlyMap<string, string> = new Map([\n  ['action', 'action'],\n  ['actions', 'action'],\n  ['provider', 'provider'],\n  ['providers', 'provider'],\n  ['mapper', 'mapper'],\n  ['mappers', 'mapper'],\n  ['service', 'service'],\n  ['services', 'service'],\n  ['credential', 'credential'],\n  ['credentials', 'credential'],\n  ['schema', 'schema'],\n  ['schemas', 'schema'],\n  ['component', 'component'],\n  ['components', 'component'],\n  ['attachment', 'attachment'],\n  ['attachments', 'attachment'],\n  ['validator', 'validator'],\n  ['validators', 'validator'],\n] as const);\nconst LAYER_KEYS = new Set([\n  'id',\n  'priority',\n  'defaultNamespace',\n  'revision',\n  'declarations',\n  'transforms',\n]);\nconst DECLARATION_KEYS = new Set(['kind', 'ref', 'schemaVersion', 'value']);\nconst TRANSFORM_KEYS = new Set(['id', 'scope', 'select', 'operation']);\nconst SELECTOR_KEYS = new Set(['kinds', 'namespaces', 'layers', 'refs', 'excludeRefs', 'tags']);\nconst OPERATION_KEYS: Readonly<Record<TransformOp, ReadonlySet<string>>> = {\n  merge: new Set(['op', 'value']),\n  replace: new Set(['op', 'value', 'ifMissing']),\n  disable: new Set(['op', 'reason']),\n  delete: new Set(['op']),\n};\nconst ATTACHMENT_TAG = '@burojs/core/trusted-attachment';\n\nexport interface SourceDiagnostic {\n  readonly code: string;\n  readonly message: string;\n}\n\nexport type ParseResult =\n  | { readonly ok: true; readonly value: LayerInput }\n  | { readonly ok: false; readonly diagnostics: readonly SourceDiagnostic[] };\n\nclass Diagnostics {\n  readonly values: SourceDiagnostic[] = [];\n  private limited = false;\n\n  constructor(private readonly limit: number) {}\n\n  add(code: string): void {\n    if (this.limited) return;\n    if (this.values.length + 1 < this.limit) {\n      this.values.push(Object.freeze({ code, message: messageFor(code) }));\n      return;\n    }\n    this.limited = true;\n    this.values.push(\n      Object.freeze({\n        code: 'source.diagnostic-limit',\n        message: messageFor('source.diagnostic-limit'),\n      }),\n    );\n  }\n}\n\nfunction messageFor(code: string): string {\n  switch (code) {\n    case 'source.invalid-json':\n      return 'The source is not valid JSON.';\n    case 'source.invalid-yaml':\n      return 'The source is not valid YAML.';\n    case 'source.invalid-policy':\n      return 'The source policy is invalid.';\n    case 'source.byte-limit':\n      return 'The source exceeds its byte limit.';\n    case 'source.declaration-limit':\n      return 'The source exceeds its declaration limit.';\n    case 'source.depth-limit':\n      return 'The source exceeds its nesting-depth limit.';\n    case 'source.string-limit':\n      return 'The source contains an overlong string.';\n    case 'source.diagnostic-limit':\n      return 'Additional source diagnostics were omitted.';\n    case 'source.unknown-key':\n      return 'The source contains an unknown key.';\n    case 'source.reserved-key':\n      return 'The source contains a reserved key.';\n    case 'source.accessor':\n      return 'The source must use data properties.';\n    case 'source.cyclic-value':\n      return 'The source must not contain cyclic values.';\n    case 'source.invalid-layer':\n      return 'The source layer is invalid.';\n    case 'source.invalid-declaration':\n      return 'The source declaration is invalid.';\n    case 'source.invalid-transform':\n      return 'The source transform is invalid.';\n    case 'source.forbidden-kind':\n      return 'The source requests a forbidden declaration kind.';\n    case 'source.forbidden-namespace':\n      return 'The source requests a forbidden namespace.';\n    case 'source.forbidden-transform-op':\n      return 'The source requests a forbidden transform operation.';\n    case 'source.forbidden-transform-scope':\n      return 'The source requests a forbidden transform scope.';\n    case 'source.forbidden-capability':\n      return 'The source requests a forbidden capability.';\n    case 'source.forbidden-action':\n      return 'The source requests a forbidden action binding.';\n    case 'source.forbidden-provider':\n      return 'The source requests a forbidden provider binding.';\n    case 'source.forbidden-mapper':\n      return 'The source requests a forbidden mapper binding.';\n    case 'source.forbidden-service':\n      return 'The source requests a forbidden service value.';\n    case 'source.forbidden-credential':\n      return 'The source requests a forbidden credential value.';\n    case 'source.forbidden-schema':\n      return 'The source requests a forbidden schema value.';\n    case 'source.forbidden-component':\n      return 'The source requests a forbidden component value.';\n    case 'source.forbidden-attachment':\n      return 'The source requests a forbidden attachment value.';\n    case 'source.forbidden-validator':\n      return 'The source requests a forbidden validator value.';\n    default:\n      return 'The source is invalid.';\n  }\n}\n\nfunction validLimits(limits: SourceLimits): boolean {\n  return Object.values(limits).every((value) => Number.isSafeInteger(value) && value > 0);\n}\n\nfunction validCapabilities(value: unknown): value is Readonly<Record<string, readonly string[]>> {\n  return (\n    value !== null &&\n    typeof value === 'object' &&\n    !Array.isArray(value) &&\n    Object.values(value).every(\n      (capabilities) =>\n        Array.isArray(capabilities) &&\n        capabilities.every((capability) => typeof capability === 'string'),\n    )\n  );\n}\n\nfunction validPolicy(policy: SourcePolicy): boolean {\n  return (\n    policy !== null &&\n    typeof policy === 'object' &&\n    Array.isArray(policy.allowedKinds) &&\n    Array.isArray(policy.allowedNamespaces) &&\n    Array.isArray(policy.allowedTransformOps) &&\n    (policy.maxTransformScope === 'layer' ||\n      policy.maxTransformScope === 'namespace' ||\n      policy.maxTransformScope === 'application') &&\n    validCapabilities(policy.allowedCapabilities) &&\n    validLimits(policy.limits)\n  );\n}\n\nfunction failure(diagnostics: Diagnostics): ParseResult {\n  return { ok: false, diagnostics: Object.freeze(diagnostics.values) };\n}\n\nfunction plainObject(value: unknown): value is Record<string, unknown> {\n  if (value === null || typeof value !== 'object' || Array.isArray(value)) return false;\n  const prototype = Object.getPrototypeOf(value);\n  return prototype === Object.prototype || prototype === null;\n}\n\nfunction ownData(value: object, key: string): unknown {\n  const descriptor = Object.getOwnPropertyDescriptor(value, key);\n  return descriptor !== undefined && 'value' in descriptor ? descriptor.value : undefined;\n}\n\nfunction hasData(value: object, key: string): boolean {\n  const descriptor = Object.getOwnPropertyDescriptor(value, key);\n  return descriptor !== undefined && 'value' in descriptor;\n}\n\nfunction clonePortable(value: unknown, limits: SourceLimits, diagnostics: Diagnostics): unknown {\n  const ancestors = new WeakSet<object>();\n\n  function copy(current: unknown, depth: number): unknown {\n    if (depth > limits.maxDepth) {\n      diagnostics.add('source.depth-limit');\n      return null;\n    }\n    if (current === null || typeof current === 'boolean' || typeof current === 'number')\n      return current;\n    if (typeof current === 'string') {\n      if ([...current].length > limits.maxStringLength) diagnostics.add('source.string-limit');\n      return current;\n    }\n    if (typeof current !== 'object') {\n      diagnostics.add('source.invalid-layer');\n      return null;\n    }\n    if (ancestors.has(current)) {\n      diagnostics.add('source.cyclic-value');\n      return null;\n    }\n    ancestors.add(current);\n\n    if (Array.isArray(current)) {\n      const output: unknown[] = [];\n      for (const key of Reflect.ownKeys(current)) {\n        if (typeof key !== 'string' || (key !== 'length' && !/^(0|[1-9]\\d*)$/u.test(key))) {\n          diagnostics.add('source.invalid-layer');\n          continue;\n        }\n        if (key === 'length') continue;\n        if (!hasData(current, key)) diagnostics.add('source.accessor');\n      }\n      const length = ownData(current, 'length');\n      const arrayLength =\n        typeof length === 'number' && Number.isSafeInteger(length) && length >= 0\n          ? length\n          : undefined;\n      if (arrayLength === undefined) diagnostics.add('source.invalid-layer');\n      else\n        for (let index = 0; index < arrayLength; index += 1) {\n          if (!hasData(current, String(index))) diagnostics.add('source.accessor');\n          output.push(copy(ownData(current, String(index)), depth + 1));\n        }\n      ancestors.delete(current);\n      return Object.freeze(output);\n    }\n\n    if (!plainObject(current)) diagnostics.add('source.invalid-layer');\n    const output: Record<string, unknown> = Object.create(null);\n    for (const key of Reflect.ownKeys(current)) {\n      if (typeof key !== 'string') {\n        diagnostics.add('source.invalid-layer');\n        continue;\n      }\n      if (RESERVED_KEYS.has(key)) diagnostics.add('source.reserved-key');\n      if ([...key].length > limits.maxStringLength) diagnostics.add('source.string-limit');\n      if (!hasData(current, key)) {\n        diagnostics.add('source.accessor');\n        continue;\n      }\n      output[key] = copy(ownData(current, key), depth + 1);\n    }\n    ancestors.delete(current);\n    return Object.freeze(output);\n  }\n\n  return copy(value, 0);\n}\n\nfunction unknownKeys(value: object, allowed: ReadonlySet<string>, diagnostics: Diagnostics): void {\n  for (const key of Object.keys(value))\n    if (!allowed.has(key)) diagnostics.add('source.unknown-key');\n}\n\nfunction allowedNamespace(value: unknown, policy: SourcePolicy, diagnostics: Diagnostics): boolean {\n  if (typeof value !== 'string' || !policy.allowedNamespaces.includes(value)) {\n    diagnostics.add('source.forbidden-namespace');\n    return false;\n  }\n  return true;\n}\n\nfunction namespaceFor(\n  ref: unknown,\n  defaultNamespace: string,\n  diagnostics: Diagnostics,\n): string | undefined {\n  if (typeof ref === 'string') {\n    const separator = ref.indexOf(':');\n    return separator === -1 ? defaultNamespace : ref.slice(0, separator);\n  }\n  if (!plainObject(ref) || !hasData(ref, 'id')) {\n    diagnostics.add('source.invalid-declaration');\n    return undefined;\n  }\n  for (const key of Object.keys(ref))\n    if (key !== 'id' && key !== 'namespace') diagnostics.add('source.unknown-key');\n  const namespace = hasData(ref, 'namespace') ? ownData(ref, 'namespace') : defaultNamespace;\n  if (typeof namespace !== 'string') diagnostics.add('source.invalid-declaration');\n  return typeof namespace === 'string' ? namespace : undefined;\n}\n\nfunction validateValue(\n  value: unknown,\n  kind: string,\n  policy: SourcePolicy,\n  diagnostics: Diagnostics,\n): void {\n  if (value === null || typeof value !== 'object') return;\n  if (Array.isArray(value)) {\n    for (const item of value) validateValue(item, kind, policy, diagnostics);\n    return;\n  }\n  if (!plainObject(value)) return;\n  if (value.$buro === ATTACHMENT_TAG) {\n    const capability = ownData(value, 'capability');\n    if (typeof capability !== 'string' || !policy.allowedCapabilities[kind]?.includes(capability)) {\n      diagnostics.add('source.forbidden-capability');\n    }\n  }\n  for (const key of Object.keys(value)) {\n    const category = FORBIDDEN_VALUE_CATEGORIES.get(key);\n    if (category !== undefined) diagnostics.add(`source.forbidden-${category}`);\n    validateValue(ownData(value, key), kind, policy, diagnostics);\n  }\n}\n\nfunction scopeRank(scope: SourcePolicy['maxTransformScope']): number {\n  return scope === 'layer' ? 0 : scope === 'namespace' ? 1 : 2;\n}\n\nfunction transformOperation(value: unknown): TransformOp | undefined {\n  if (!plainObject(value)) return undefined;\n  const operation = ownData(value, 'op');\n  return operation === 'merge' ||\n    operation === 'replace' ||\n    operation === 'disable' ||\n    operation === 'delete'\n    ? operation\n    : undefined;\n}\n\nfunction validateSelectorRefs(\n  value: unknown,\n  defaultNamespace: string,\n  policy: SourcePolicy,\n  diagnostics: Diagnostics,\n): void {\n  if (value === undefined) return;\n  if (!Array.isArray(value)) {\n    diagnostics.add('source.invalid-transform');\n    return;\n  }\n  for (const ref of value) {\n    const namespace = namespaceFor(ref, defaultNamespace, diagnostics);\n    if (namespace !== undefined) allowedNamespace(namespace, policy, diagnostics);\n  }\n}\n\nfunction validateTransforms(\n  value: unknown,\n  defaultNamespace: string,\n  policy: SourcePolicy,\n  diagnostics: Diagnostics,\n): void {\n  if (value === undefined) return;\n  if (!Array.isArray(value)) {\n    diagnostics.add('source.invalid-transform');\n    return;\n  }\n  for (const transform of value) {\n    if (!plainObject(transform)) {\n      diagnostics.add('source.invalid-transform');\n      continue;\n    }\n    unknownKeys(transform, TRANSFORM_KEYS, diagnostics);\n    const scope = ownData(transform, 'scope') ?? 'layer';\n    if (scope !== 'layer' && scope !== 'application') diagnostics.add('source.invalid-transform');\n    else if (scopeRank(scope) > scopeRank(policy.maxTransformScope))\n      diagnostics.add('source.forbidden-transform-scope');\n    const select = ownData(transform, 'select');\n    if (!plainObject(select)) diagnostics.add('source.invalid-transform');\n    else {\n      unknownKeys(select, SELECTOR_KEYS, diagnostics);\n      const selectedKinds = ownData(select, 'kinds');\n      if (selectedKinds !== undefined) {\n        if (!Array.isArray(selectedKinds)) diagnostics.add('source.invalid-transform');\n        else\n          for (const kind of selectedKinds) {\n            if (typeof kind !== 'string') diagnostics.add('source.invalid-transform');\n            else if (!policy.allowedKinds.includes(kind)) diagnostics.add('source.forbidden-kind');\n          }\n      }\n      const selectedNamespaces = ownData(select, 'namespaces');\n      if (selectedNamespaces !== undefined) {\n        if (!Array.isArray(selectedNamespaces)) diagnostics.add('source.invalid-transform');\n        else\n          for (const namespace of selectedNamespaces)\n            allowedNamespace(namespace, policy, diagnostics);\n      }\n      validateSelectorRefs(ownData(select, 'refs'), defaultNamespace, policy, diagnostics);\n      validateSelectorRefs(ownData(select, 'excludeRefs'), defaultNamespace, policy, diagnostics);\n    }\n    const operation = ownData(transform, 'operation');\n    const op = transformOperation(operation);\n    const rawOp = plainObject(operation) ? ownData(operation, 'op') : undefined;\n    if (typeof rawOp === 'string' && op === undefined)\n      diagnostics.add('source.forbidden-transform-op');\n    else if (op === undefined) diagnostics.add('source.invalid-transform');\n    else {\n      if (!policy.allowedTransformOps.includes(op))\n        diagnostics.add('source.forbidden-transform-op');\n      if (plainObject(operation)) {\n        unknownKeys(operation, OPERATION_KEYS[op], diagnostics);\n        if (hasData(operation, 'value'))\n          validateValue(ownData(operation, 'value'), '', policy, diagnostics);\n      }\n    }\n  }\n}\n\n/** Validates and clones a parser-produced value without retaining source-owned object references. */\nexport function validateLayerValue(value: unknown, policy: SourcePolicy): ParseResult {\n  if (!validPolicy(policy)) {\n    return {\n      ok: false,\n      diagnostics: Object.freeze([\n        Object.freeze({\n          code: 'source.invalid-policy',\n          message: messageFor('source.invalid-policy'),\n        }),\n      ]),\n    };\n  }\n  const diagnostics = new Diagnostics(policy.limits.maxDiagnostics);\n  const cloned = clonePortable(value, policy.limits, diagnostics);\n  if (diagnostics.values.length > 0) return failure(diagnostics);\n  if (!plainObject(cloned)) {\n    diagnostics.add('source.invalid-layer');\n    return failure(diagnostics);\n  }\n  unknownKeys(cloned, LAYER_KEYS, diagnostics);\n  const id = ownData(cloned, 'id');\n  const priority = ownData(cloned, 'priority');\n  const declarations = ownData(cloned, 'declarations');\n  if (typeof id !== 'string' || !Number.isSafeInteger(priority) || !Array.isArray(declarations)) {\n    diagnostics.add('source.invalid-layer');\n    return failure(diagnostics);\n  }\n  if (declarations.length > policy.limits.maxDeclarations)\n    diagnostics.add('source.declaration-limit');\n  const rawDefaultNamespace = ownData(cloned, 'defaultNamespace');\n  const defaultNamespace = rawDefaultNamespace === undefined ? 'default' : rawDefaultNamespace;\n  if (typeof defaultNamespace !== 'string') diagnostics.add('source.invalid-layer');\n  else allowedNamespace(defaultNamespace, policy, diagnostics);\n  for (const declaration of declarations) {\n    if (!plainObject(declaration)) {\n      diagnostics.add('source.invalid-declaration');\n      continue;\n    }\n    unknownKeys(declaration, DECLARATION_KEYS, diagnostics);\n    const kind = ownData(declaration, 'kind');\n    if (typeof kind !== 'string') diagnostics.add('source.invalid-declaration');\n    else if (!policy.allowedKinds.includes(kind)) diagnostics.add('source.forbidden-kind');\n    const namespace = namespaceFor(\n      ownData(declaration, 'ref'),\n      typeof defaultNamespace === 'string' ? defaultNamespace : 'default',\n      diagnostics,\n    );\n    if (namespace !== undefined) allowedNamespace(namespace, policy, diagnostics);\n    if (\n      !Number.isSafeInteger(ownData(declaration, 'schemaVersion')) ||\n      !hasData(declaration, 'value')\n    ) {\n      diagnostics.add('source.invalid-declaration');\n    }\n    if (typeof kind === 'string' && hasData(declaration, 'value')) {\n      validateValue(ownData(declaration, 'value'), kind, policy, diagnostics);\n    }\n  }\n  validateTransforms(\n    ownData(cloned, 'transforms'),\n    typeof defaultNamespace === 'string' ? defaultNamespace : 'default',\n    policy,\n    diagnostics,\n  );\n  if (diagnostics.values.length > 0) return failure(diagnostics);\n  return { ok: true, value: cloned as unknown as LayerInput };\n}\n\nfunction byteLength(value: string): number {\n  return new TextEncoder().encode(value).byteLength;\n}\n\nfunction parseSource(source: string, policy: SourcePolicy, format: 'json' | 'yaml'): ParseResult {\n  if (!validPolicy(policy)) return validateLayerValue(null, policy);\n  const diagnostics = new Diagnostics(policy.limits.maxDiagnostics);\n  if (byteLength(source) > policy.limits.maxBytes) {\n    diagnostics.add('source.byte-limit');\n    return failure(diagnostics);\n  }\n  try {\n    if (format === 'json') return validateLayerValue(JSON.parse(source), policy);\n    const document = parseDocument(source, { prettyErrors: false, strict: true, uniqueKeys: true });\n    if (document.errors.length > 0) {\n      diagnostics.add('source.invalid-yaml');\n      return failure(diagnostics);\n    }\n    return validateLayerValue(document.toJS({ maxAliasCount: 0 }), policy);\n  } catch {\n    diagnostics.add(format === 'json' ? 'source.invalid-json' : 'source.invalid-yaml');\n    return failure(diagnostics);\n  }\n}\n\nexport function parseJsonLayer(source: string, policy: SourcePolicy): ParseResult {\n  return parseSource(source, policy, 'json');\n}\n\nexport function parseYamlLayer(source: string, policy: SourcePolicy): ParseResult {\n  return parseSource(source, policy, 'yaml');\n}\n","import type { LayerInput } from '@burojs/core';\nimport { type ParseResult, type SourceDiagnostic, validateLayerValue } from './parse.js';\nimport type { SourceLimits, SourcePolicy } from './source-policy.js';\n\n/** The portable parsed configuration form supplied by the built-in JSON/YAML readers. */\nexport type RawConfig = ParseResult;\n\n/** A framework-owned, inert declaration layer. Trusted attachments are intentionally excluded. */\nexport interface AdapterResult {\n  readonly layer?: LayerInput;\n  readonly diagnostics?: readonly SourceDiagnostic[];\n}\n\n/**\n * Immutable host-owned policy and diagnostic boundary supplied to an adapter.\n * Calling `diagnose` records a controlled diagnostic; it cannot publish or\n * otherwise mutate an application runtime.\n */\nexport interface AdapterContext {\n  readonly policy: SourcePolicy;\n  readonly limits: SourceLimits;\n  diagnose(code: string, message: string): void;\n}\n\n/** Pure conversion from one raw source format into inert declarations. */\nexport interface SourceAdapter<TInput> {\n  adapt(input: TInput, context: AdapterContext): AdapterResult;\n}\n\nfunction diagnostic(code: string, message: string): SourceDiagnostic {\n  return Object.freeze({ code, message });\n}\n\nfunction diagnosticLimit(policy: SourcePolicy): number {\n  const candidate = policy?.limits?.maxDiagnostics;\n  return typeof candidate === 'number' && Number.isSafeInteger(candidate) && candidate > 0\n    ? candidate\n    : 1;\n}\n\nfunction frozenPolicy(policy: SourcePolicy): SourcePolicy {\n  const capabilities: Record<string, readonly string[]> = Object.create(null);\n  for (const [kind, values] of Object.entries(policy.allowedCapabilities)) {\n    capabilities[kind] = Object.freeze([...values]);\n  }\n  const limits = Object.freeze({ ...policy.limits });\n  return Object.freeze({\n    allowedKinds: Object.freeze([...policy.allowedKinds]),\n    allowedNamespaces: Object.freeze([...policy.allowedNamespaces]),\n    allowedTransformOps: Object.freeze([...policy.allowedTransformOps]),\n    maxTransformScope: policy.maxTransformScope,\n    allowedCapabilities: Object.freeze(capabilities),\n    limits,\n  });\n}\n\nfunction copyDiagnostic(value: unknown): SourceDiagnostic {\n  if (\n    value !== null &&\n    typeof value === 'object' &&\n    typeof (value as { readonly code?: unknown }).code === 'string' &&\n    typeof (value as { readonly message?: unknown }).message === 'string'\n  ) {\n    return diagnostic(\n      (value as { readonly code: string }).code,\n      (value as { readonly message: string }).message,\n    );\n  }\n  return diagnostic(\n    'source.invalid-adapter-diagnostic',\n    'The source adapter returned an invalid diagnostic.',\n  );\n}\n\n/**\n * Runs a pure adapter and applies the source policy again to its output before\n * it can reach a runtime. This is deliberately independent of `LayerRuntime`.\n */\nexport function adaptRawConfig<TInput>(\n  input: TInput,\n  adapter: SourceAdapter<TInput>,\n  policy: SourcePolicy,\n): ParseResult {\n  const policyValidation = validateLayerValue(null, policy);\n  if (\n    !policyValidation.ok &&\n    policyValidation.diagnostics.some((entry) => entry.code === 'source.invalid-policy')\n  ) {\n    return policyValidation;\n  }\n  const ownedPolicy = frozenPolicy(policy);\n  const diagnostics: SourceDiagnostic[] = [];\n  const maxDiagnostics = diagnosticLimit(ownedPolicy);\n  let limited = false;\n  const add = (value: SourceDiagnostic): void => {\n    if (limited) return;\n    if (diagnostics.length + 1 < maxDiagnostics) {\n      diagnostics.push(value);\n      return;\n    }\n    limited = true;\n    diagnostics.push(\n      diagnostic('source.diagnostic-limit', 'Additional source diagnostics were omitted.'),\n    );\n  };\n  const context: AdapterContext = Object.freeze({\n    policy: ownedPolicy,\n    limits: ownedPolicy.limits,\n    diagnose(code: string, message: string) {\n      add(copyDiagnostic({ code, message }));\n    },\n  });\n  const result = adapter.adapt(input, context);\n  if (result === null || typeof result !== 'object') {\n    add(\n      diagnostic('source.invalid-adapter-result', 'The source adapter returned an invalid result.'),\n    );\n  } else if (result.diagnostics !== undefined) {\n    if (!Array.isArray(result.diagnostics)) {\n      add(\n        diagnostic(\n          'source.invalid-adapter-result',\n          'The source adapter returned an invalid result.',\n        ),\n      );\n    } else {\n      for (const entry of result.diagnostics) add(copyDiagnostic(entry));\n    }\n  }\n  if (diagnostics.length > 0) {\n    return { ok: false, diagnostics: Object.freeze(diagnostics) };\n  }\n  if (result === null || typeof result !== 'object' || result.layer === undefined) {\n    return {\n      ok: false,\n      diagnostics: Object.freeze([\n        diagnostic(\n          'source.invalid-adapter-result',\n          'The source adapter did not return a declaration layer.',\n        ),\n      ]),\n    };\n  }\n  return validateLayerValue(result.layer, ownedPolicy);\n}\n\n/** Adapts the built-in JSON/YAML parse result without adding any executable data. */\nexport const parseResultAdapter: SourceAdapter<RawConfig> = Object.freeze({\n  adapt(input: RawConfig) {\n    return input.ok ? { layer: input.value } : { diagnostics: input.diagnostics };\n  },\n});\n","import type { RuntimeSource, RuntimeSourceFailure, SourceLoadContext } from '@burojs/core';\nimport { type RawConfig, type SourceAdapter, adaptRawConfig } from './adapter.js';\nimport type { SourceDiagnostic } from './parse.js';\nimport type { SourcePolicy } from './source-policy.js';\n\nfunction adaptationFailure(diagnostics: readonly SourceDiagnostic[]): RuntimeSourceFailure {\n  return Object.freeze({\n    status: 'rejected',\n    diagnostics: Object.freeze(\n      diagnostics.map((entry) => Object.freeze({ code: entry.code, message: entry.message })),\n    ),\n  });\n}\n\n/**\n * Builds a normal core runtime source for inert configuration. Publication,\n * cancellation, epochs, and snapshot commits remain owned by `LayerRuntime`.\n */\nexport function createConfigRuntimeSource(\n  id: string,\n  fetchRaw: (context: SourceLoadContext) => Promise<RawConfig>,\n  adapter: SourceAdapter<RawConfig>,\n  policy: SourcePolicy,\n): RuntimeSource {\n  return Object.freeze({\n    id,\n    async load(context: SourceLoadContext) {\n      const raw = await fetchRaw(context);\n      const adapted = adaptRawConfig(raw, adapter, policy);\n      if (!adapted.ok) return adaptationFailure(adapted.diagnostics);\n      return adapted.value;\n    },\n  });\n}\n"],"mappings":";;AAIA,MAAM,gBAAgB,IAAI,IAAI;CAAC;CAAa;CAAa;AAAa,CAAC;AACvE,MAAM,6BAA0D,IAAI,IAAI;CACtE,CAAC,UAAU,QAAQ;CACnB,CAAC,WAAW,QAAQ;CACpB,CAAC,YAAY,UAAU;CACvB,CAAC,aAAa,UAAU;CACxB,CAAC,UAAU,QAAQ;CACnB,CAAC,WAAW,QAAQ;CACpB,CAAC,WAAW,SAAS;CACrB,CAAC,YAAY,SAAS;CACtB,CAAC,cAAc,YAAY;CAC3B,CAAC,eAAe,YAAY;CAC5B,CAAC,UAAU,QAAQ;CACnB,CAAC,WAAW,QAAQ;CACpB,CAAC,aAAa,WAAW;CACzB,CAAC,cAAc,WAAW;CAC1B,CAAC,cAAc,YAAY;CAC3B,CAAC,eAAe,YAAY;CAC5B,CAAC,aAAa,WAAW;CACzB,CAAC,cAAc,WAAW;AAC5B,CAAU;AACV,MAAM,aAAa,IAAI,IAAI;CACzB;CACA;CACA;CACA;CACA;CACA;AACF,CAAC;AACD,MAAM,mBAAmB,IAAI,IAAI;CAAC;CAAQ;CAAO;CAAiB;AAAO,CAAC;AAC1E,MAAM,iBAAiB,IAAI,IAAI;CAAC;CAAM;CAAS;CAAU;AAAW,CAAC;AACrE,MAAM,gBAAgB,IAAI,IAAI;CAAC;CAAS;CAAc;CAAU;CAAQ;CAAe;AAAM,CAAC;AAC9F,MAAM,iBAAqE;CACzE,OAAO,IAAI,IAAI,CAAC,MAAM,OAAO,CAAC;CAC9B,SAAS,IAAI,IAAI;EAAC;EAAM;EAAS;CAAW,CAAC;CAC7C,SAAS,IAAI,IAAI,CAAC,MAAM,QAAQ,CAAC;CACjC,QAAQ,IAAI,IAAI,CAAC,IAAI,CAAC;AACxB;AACA,MAAM,iBAAiB;AAWvB,IAAM,cAAN,MAAkB;CAIa;CAH7B,SAAsC,CAAC;CACvC,UAAkB;CAElB,YAAY,OAAgC;EAAf,KAAA,QAAA;CAAgB;CAE7C,IAAI,MAAoB;EACtB,IAAI,KAAK,SAAS;EAClB,IAAI,KAAK,OAAO,SAAS,IAAI,KAAK,OAAO;GACvC,KAAK,OAAO,KAAK,OAAO,OAAO;IAAE;IAAM,SAAS,WAAW,IAAI;GAAE,CAAC,CAAC;GACnE;EACF;EACA,KAAK,UAAU;EACf,KAAK,OAAO,KACV,OAAO,OAAO;GACZ,MAAM;GACN,SAAS,WAAW,yBAAyB;EAC/C,CAAC,CACH;CACF;AACF;AAEA,SAAS,WAAW,MAAsB;CACxC,QAAQ,MAAR;EACE,KAAK,uBACH,OAAO;EACT,KAAK,uBACH,OAAO;EACT,KAAK,yBACH,OAAO;EACT,KAAK,qBACH,OAAO;EACT,KAAK,4BACH,OAAO;EACT,KAAK,sBACH,OAAO;EACT,KAAK,uBACH,OAAO;EACT,KAAK,2BACH,OAAO;EACT,KAAK,sBACH,OAAO;EACT,KAAK,uBACH,OAAO;EACT,KAAK,mBACH,OAAO;EACT,KAAK,uBACH,OAAO;EACT,KAAK,wBACH,OAAO;EACT,KAAK,8BACH,OAAO;EACT,KAAK,4BACH,OAAO;EACT,KAAK,yBACH,OAAO;EACT,KAAK,8BACH,OAAO;EACT,KAAK,iCACH,OAAO;EACT,KAAK,oCACH,OAAO;EACT,KAAK,+BACH,OAAO;EACT,KAAK,2BACH,OAAO;EACT,KAAK,6BACH,OAAO;EACT,KAAK,2BACH,OAAO;EACT,KAAK,4BACH,OAAO;EACT,KAAK,+BACH,OAAO;EACT,KAAK,2BACH,OAAO;EACT,KAAK,8BACH,OAAO;EACT,KAAK,+BACH,OAAO;EACT,KAAK,8BACH,OAAO;EACT,SACE,OAAO;CACX;AACF;AAEA,SAAS,YAAY,QAA+B;CAClD,OAAO,OAAO,OAAO,MAAM,CAAC,CAAC,OAAO,UAAU,OAAO,cAAc,KAAK,KAAK,QAAQ,CAAC;AACxF;AAEA,SAAS,kBAAkB,OAAsE;CAC/F,OACE,UAAU,QACV,OAAO,UAAU,YACjB,CAAC,MAAM,QAAQ,KAAK,KACpB,OAAO,OAAO,KAAK,CAAC,CAAC,OAClB,iBACC,MAAM,QAAQ,YAAY,KAC1B,aAAa,OAAO,eAAe,OAAO,eAAe,QAAQ,CACrE;AAEJ;AAEA,SAAS,YAAY,QAA+B;CAClD,OACE,WAAW,QACX,OAAO,WAAW,YAClB,MAAM,QAAQ,OAAO,YAAY,KACjC,MAAM,QAAQ,OAAO,iBAAiB,KACtC,MAAM,QAAQ,OAAO,mBAAmB,MACvC,OAAO,sBAAsB,WAC5B,OAAO,sBAAsB,eAC7B,OAAO,sBAAsB,kBAC/B,kBAAkB,OAAO,mBAAmB,KAC5C,YAAY,OAAO,MAAM;AAE7B;AAEA,SAAS,QAAQ,aAAuC;CACtD,OAAO;EAAE,IAAI;EAAO,aAAa,OAAO,OAAO,YAAY,MAAM;CAAE;AACrE;AAEA,SAAS,YAAY,OAAkD;CACrE,IAAI,UAAU,QAAQ,OAAO,UAAU,YAAY,MAAM,QAAQ,KAAK,GAAG,OAAO;CAChF,MAAM,YAAY,OAAO,eAAe,KAAK;CAC7C,OAAO,cAAc,OAAO,aAAa,cAAc;AACzD;AAEA,SAAS,QAAQ,OAAe,KAAsB;CACpD,MAAM,aAAa,OAAO,yBAAyB,OAAO,GAAG;CAC7D,OAAO,eAAe,KAAA,KAAa,WAAW,aAAa,WAAW,QAAQ,KAAA;AAChF;AAEA,SAAS,QAAQ,OAAe,KAAsB;CACpD,MAAM,aAAa,OAAO,yBAAyB,OAAO,GAAG;CAC7D,OAAO,eAAe,KAAA,KAAa,WAAW;AAChD;AAEA,SAAS,cAAc,OAAgB,QAAsB,aAAmC;CAC9F,MAAM,YAAY,IAAI,QAAgB;CAEtC,SAAS,KAAK,SAAkB,OAAwB;EACtD,IAAI,QAAQ,OAAO,UAAU;GAC3B,YAAY,IAAI,oBAAoB;GACpC,OAAO;EACT;EACA,IAAI,YAAY,QAAQ,OAAO,YAAY,aAAa,OAAO,YAAY,UACzE,OAAO;EACT,IAAI,OAAO,YAAY,UAAU;GAC/B,IAAI,CAAC,GAAG,OAAO,CAAC,CAAC,SAAS,OAAO,iBAAiB,YAAY,IAAI,qBAAqB;GACvF,OAAO;EACT;EACA,IAAI,OAAO,YAAY,UAAU;GAC/B,YAAY,IAAI,sBAAsB;GACtC,OAAO;EACT;EACA,IAAI,UAAU,IAAI,OAAO,GAAG;GAC1B,YAAY,IAAI,qBAAqB;GACrC,OAAO;EACT;EACA,UAAU,IAAI,OAAO;EAErB,IAAI,MAAM,QAAQ,OAAO,GAAG;GAC1B,MAAM,SAAoB,CAAC;GAC3B,KAAK,MAAM,OAAO,QAAQ,QAAQ,OAAO,GAAG;IAC1C,IAAI,OAAO,QAAQ,YAAa,QAAQ,YAAY,CAAC,kBAAkB,KAAK,GAAG,GAAI;KACjF,YAAY,IAAI,sBAAsB;KACtC;IACF;IACA,IAAI,QAAQ,UAAU;IACtB,IAAI,CAAC,QAAQ,SAAS,GAAG,GAAG,YAAY,IAAI,iBAAiB;GAC/D;GACA,MAAM,SAAS,QAAQ,SAAS,QAAQ;GACxC,MAAM,cACJ,OAAO,WAAW,YAAY,OAAO,cAAc,MAAM,KAAK,UAAU,IACpE,SACA,KAAA;GACN,IAAI,gBAAgB,KAAA,GAAW,YAAY,IAAI,sBAAsB;QAEnE,KAAK,IAAI,QAAQ,GAAG,QAAQ,aAAa,SAAS,GAAG;IACnD,IAAI,CAAC,QAAQ,SAAS,OAAO,KAAK,CAAC,GAAG,YAAY,IAAI,iBAAiB;IACvE,OAAO,KAAK,KAAK,QAAQ,SAAS,OAAO,KAAK,CAAC,GAAG,QAAQ,CAAC,CAAC;GAC9D;GACF,UAAU,OAAO,OAAO;GACxB,OAAO,OAAO,OAAO,MAAM;EAC7B;EAEA,IAAI,CAAC,YAAY,OAAO,GAAG,YAAY,IAAI,sBAAsB;EACjE,MAAM,SAAkC,OAAO,OAAO,IAAI;EAC1D,KAAK,MAAM,OAAO,QAAQ,QAAQ,OAAO,GAAG;GAC1C,IAAI,OAAO,QAAQ,UAAU;IAC3B,YAAY,IAAI,sBAAsB;IACtC;GACF;GACA,IAAI,cAAc,IAAI,GAAG,GAAG,YAAY,IAAI,qBAAqB;GACjE,IAAI,CAAC,GAAG,GAAG,CAAC,CAAC,SAAS,OAAO,iBAAiB,YAAY,IAAI,qBAAqB;GACnF,IAAI,CAAC,QAAQ,SAAS,GAAG,GAAG;IAC1B,YAAY,IAAI,iBAAiB;IACjC;GACF;GACA,OAAO,OAAO,KAAK,QAAQ,SAAS,GAAG,GAAG,QAAQ,CAAC;EACrD;EACA,UAAU,OAAO,OAAO;EACxB,OAAO,OAAO,OAAO,MAAM;CAC7B;CAEA,OAAO,KAAK,OAAO,CAAC;AACtB;AAEA,SAAS,YAAY,OAAe,SAA8B,aAAgC;CAChG,KAAK,MAAM,OAAO,OAAO,KAAK,KAAK,GACjC,IAAI,CAAC,QAAQ,IAAI,GAAG,GAAG,YAAY,IAAI,oBAAoB;AAC/D;AAEA,SAAS,iBAAiB,OAAgB,QAAsB,aAAmC;CACjG,IAAI,OAAO,UAAU,YAAY,CAAC,OAAO,kBAAkB,SAAS,KAAK,GAAG;EAC1E,YAAY,IAAI,4BAA4B;EAC5C,OAAO;CACT;CACA,OAAO;AACT;AAEA,SAAS,aACP,KACA,kBACA,aACoB;CACpB,IAAI,OAAO,QAAQ,UAAU;EAC3B,MAAM,YAAY,IAAI,QAAQ,GAAG;EACjC,OAAO,cAAc,KAAK,mBAAmB,IAAI,MAAM,GAAG,SAAS;CACrE;CACA,IAAI,CAAC,YAAY,GAAG,KAAK,CAAC,QAAQ,KAAK,IAAI,GAAG;EAC5C,YAAY,IAAI,4BAA4B;EAC5C;CACF;CACA,KAAK,MAAM,OAAO,OAAO,KAAK,GAAG,GAC/B,IAAI,QAAQ,QAAQ,QAAQ,aAAa,YAAY,IAAI,oBAAoB;CAC/E,MAAM,YAAY,QAAQ,KAAK,WAAW,IAAI,QAAQ,KAAK,WAAW,IAAI;CAC1E,IAAI,OAAO,cAAc,UAAU,YAAY,IAAI,4BAA4B;CAC/E,OAAO,OAAO,cAAc,WAAW,YAAY,KAAA;AACrD;AAEA,SAAS,cACP,OACA,MACA,QACA,aACM;CACN,IAAI,UAAU,QAAQ,OAAO,UAAU,UAAU;CACjD,IAAI,MAAM,QAAQ,KAAK,GAAG;EACxB,KAAK,MAAM,QAAQ,OAAO,cAAc,MAAM,MAAM,QAAQ,WAAW;EACvE;CACF;CACA,IAAI,CAAC,YAAY,KAAK,GAAG;CACzB,IAAI,MAAM,UAAU,gBAAgB;EAClC,MAAM,aAAa,QAAQ,OAAO,YAAY;EAC9C,IAAI,OAAO,eAAe,YAAY,CAAC,OAAO,oBAAoB,KAAK,EAAE,SAAS,UAAU,GAC1F,YAAY,IAAI,6BAA6B;CAEjD;CACA,KAAK,MAAM,OAAO,OAAO,KAAK,KAAK,GAAG;EACpC,MAAM,WAAW,2BAA2B,IAAI,GAAG;EACnD,IAAI,aAAa,KAAA,GAAW,YAAY,IAAI,oBAAoB,UAAU;EAC1E,cAAc,QAAQ,OAAO,GAAG,GAAG,MAAM,QAAQ,WAAW;CAC9D;AACF;AAEA,SAAS,UAAU,OAAkD;CACnE,OAAO,UAAU,UAAU,IAAI,UAAU,cAAc,IAAI;AAC7D;AAEA,SAAS,mBAAmB,OAAyC;CACnE,IAAI,CAAC,YAAY,KAAK,GAAG,OAAO,KAAA;CAChC,MAAM,YAAY,QAAQ,OAAO,IAAI;CACrC,OAAO,cAAc,WACnB,cAAc,aACd,cAAc,aACd,cAAc,WACZ,YACA,KAAA;AACN;AAEA,SAAS,qBACP,OACA,kBACA,QACA,aACM;CACN,IAAI,UAAU,KAAA,GAAW;CACzB,IAAI,CAAC,MAAM,QAAQ,KAAK,GAAG;EACzB,YAAY,IAAI,0BAA0B;EAC1C;CACF;CACA,KAAK,MAAM,OAAO,OAAO;EACvB,MAAM,YAAY,aAAa,KAAK,kBAAkB,WAAW;EACjE,IAAI,cAAc,KAAA,GAAW,iBAAiB,WAAW,QAAQ,WAAW;CAC9E;AACF;AAEA,SAAS,mBACP,OACA,kBACA,QACA,aACM;CACN,IAAI,UAAU,KAAA,GAAW;CACzB,IAAI,CAAC,MAAM,QAAQ,KAAK,GAAG;EACzB,YAAY,IAAI,0BAA0B;EAC1C;CACF;CACA,KAAK,MAAM,aAAa,OAAO;EAC7B,IAAI,CAAC,YAAY,SAAS,GAAG;GAC3B,YAAY,IAAI,0BAA0B;GAC1C;EACF;EACA,YAAY,WAAW,gBAAgB,WAAW;EAClD,MAAM,QAAQ,QAAQ,WAAW,OAAO,KAAK;EAC7C,IAAI,UAAU,WAAW,UAAU,eAAe,YAAY,IAAI,0BAA0B;OACvF,IAAI,UAAU,KAAK,IAAI,UAAU,OAAO,iBAAiB,GAC5D,YAAY,IAAI,kCAAkC;EACpD,MAAM,SAAS,QAAQ,WAAW,QAAQ;EAC1C,IAAI,CAAC,YAAY,MAAM,GAAG,YAAY,IAAI,0BAA0B;OAC/D;GACH,YAAY,QAAQ,eAAe,WAAW;GAC9C,MAAM,gBAAgB,QAAQ,QAAQ,OAAO;GAC7C,IAAI,kBAAkB,KAAA,GAAW;IAC/B,IAAI,CAAC,MAAM,QAAQ,aAAa,GAAG,YAAY,IAAI,0BAA0B;SAE3E,KAAK,MAAM,QAAQ,eACjB,IAAI,OAAO,SAAS,UAAU,YAAY,IAAI,0BAA0B;SACnE,IAAI,CAAC,OAAO,aAAa,SAAS,IAAI,GAAG,YAAY,IAAI,uBAAuB;GAE3F;GACA,MAAM,qBAAqB,QAAQ,QAAQ,YAAY;GACvD,IAAI,uBAAuB,KAAA,GAAW;IACpC,IAAI,CAAC,MAAM,QAAQ,kBAAkB,GAAG,YAAY,IAAI,0BAA0B;SAEhF,KAAK,MAAM,aAAa,oBACtB,iBAAiB,WAAW,QAAQ,WAAW;GACrD;GACA,qBAAqB,QAAQ,QAAQ,MAAM,GAAG,kBAAkB,QAAQ,WAAW;GACnF,qBAAqB,QAAQ,QAAQ,aAAa,GAAG,kBAAkB,QAAQ,WAAW;EAC5F;EACA,MAAM,YAAY,QAAQ,WAAW,WAAW;EAChD,MAAM,KAAK,mBAAmB,SAAS;EAEvC,IAAI,QADU,YAAY,SAAS,IAAI,QAAQ,WAAW,IAAI,IAAI,KAAA,OAC7C,YAAY,OAAO,KAAA,GACtC,YAAY,IAAI,+BAA+B;OAC5C,IAAI,OAAO,KAAA,GAAW,YAAY,IAAI,0BAA0B;OAChE;GACH,IAAI,CAAC,OAAO,oBAAoB,SAAS,EAAE,GACzC,YAAY,IAAI,+BAA+B;GACjD,IAAI,YAAY,SAAS,GAAG;IAC1B,YAAY,WAAW,eAAe,KAAK,WAAW;IACtD,IAAI,QAAQ,WAAW,OAAO,GAC5B,cAAc,QAAQ,WAAW,OAAO,GAAG,IAAI,QAAQ,WAAW;GACtE;EACF;CACF;AACF;AAGA,SAAgB,mBAAmB,OAAgB,QAAmC;CACpF,IAAI,CAAC,YAAY,MAAM,GACrB,OAAO;EACL,IAAI;EACJ,aAAa,OAAO,OAAO,CACzB,OAAO,OAAO;GACZ,MAAM;GACN,SAAS,WAAW,uBAAuB;EAC7C,CAAC,CACH,CAAC;CACH;CAEF,MAAM,cAAc,IAAI,YAAY,OAAO,OAAO,cAAc;CAChE,MAAM,SAAS,cAAc,OAAO,OAAO,QAAQ,WAAW;CAC9D,IAAI,YAAY,OAAO,SAAS,GAAG,OAAO,QAAQ,WAAW;CAC7D,IAAI,CAAC,YAAY,MAAM,GAAG;EACxB,YAAY,IAAI,sBAAsB;EACtC,OAAO,QAAQ,WAAW;CAC5B;CACA,YAAY,QAAQ,YAAY,WAAW;CAC3C,MAAM,KAAK,QAAQ,QAAQ,IAAI;CAC/B,MAAM,WAAW,QAAQ,QAAQ,UAAU;CAC3C,MAAM,eAAe,QAAQ,QAAQ,cAAc;CACnD,IAAI,OAAO,OAAO,YAAY,CAAC,OAAO,cAAc,QAAQ,KAAK,CAAC,MAAM,QAAQ,YAAY,GAAG;EAC7F,YAAY,IAAI,sBAAsB;EACtC,OAAO,QAAQ,WAAW;CAC5B;CACA,IAAI,aAAa,SAAS,OAAO,OAAO,iBACtC,YAAY,IAAI,0BAA0B;CAC5C,MAAM,sBAAsB,QAAQ,QAAQ,kBAAkB;CAC9D,MAAM,mBAAmB,wBAAwB,KAAA,IAAY,YAAY;CACzE,IAAI,OAAO,qBAAqB,UAAU,YAAY,IAAI,sBAAsB;MAC3E,iBAAiB,kBAAkB,QAAQ,WAAW;CAC3D,KAAK,MAAM,eAAe,cAAc;EACtC,IAAI,CAAC,YAAY,WAAW,GAAG;GAC7B,YAAY,IAAI,4BAA4B;GAC5C;EACF;EACA,YAAY,aAAa,kBAAkB,WAAW;EACtD,MAAM,OAAO,QAAQ,aAAa,MAAM;EACxC,IAAI,OAAO,SAAS,UAAU,YAAY,IAAI,4BAA4B;OACrE,IAAI,CAAC,OAAO,aAAa,SAAS,IAAI,GAAG,YAAY,IAAI,uBAAuB;EACrF,MAAM,YAAY,aAChB,QAAQ,aAAa,KAAK,GAC1B,OAAO,qBAAqB,WAAW,mBAAmB,WAC1D,WACF;EACA,IAAI,cAAc,KAAA,GAAW,iBAAiB,WAAW,QAAQ,WAAW;EAC5E,IACE,CAAC,OAAO,cAAc,QAAQ,aAAa,eAAe,CAAC,KAC3D,CAAC,QAAQ,aAAa,OAAO,GAE7B,YAAY,IAAI,4BAA4B;EAE9C,IAAI,OAAO,SAAS,YAAY,QAAQ,aAAa,OAAO,GAC1D,cAAc,QAAQ,aAAa,OAAO,GAAG,MAAM,QAAQ,WAAW;CAE1E;CACA,mBACE,QAAQ,QAAQ,YAAY,GAC5B,OAAO,qBAAqB,WAAW,mBAAmB,WAC1D,QACA,WACF;CACA,IAAI,YAAY,OAAO,SAAS,GAAG,OAAO,QAAQ,WAAW;CAC7D,OAAO;EAAE,IAAI;EAAM,OAAO;CAAgC;AAC5D;AAEA,SAAS,WAAW,OAAuB;CACzC,OAAO,IAAI,YAAY,CAAC,CAAC,OAAO,KAAK,CAAC,CAAC;AACzC;AAEA,SAAS,YAAY,QAAgB,QAAsB,QAAsC;CAC/F,IAAI,CAAC,YAAY,MAAM,GAAG,OAAO,mBAAmB,MAAM,MAAM;CAChE,MAAM,cAAc,IAAI,YAAY,OAAO,OAAO,cAAc;CAChE,IAAI,WAAW,MAAM,IAAI,OAAO,OAAO,UAAU;EAC/C,YAAY,IAAI,mBAAmB;EACnC,OAAO,QAAQ,WAAW;CAC5B;CACA,IAAI;EACF,IAAI,WAAW,QAAQ,OAAO,mBAAmB,KAAK,MAAM,MAAM,GAAG,MAAM;EAC3E,MAAM,WAAW,cAAc,QAAQ;GAAE,cAAc;GAAO,QAAQ;GAAM,YAAY;EAAK,CAAC;EAC9F,IAAI,SAAS,OAAO,SAAS,GAAG;GAC9B,YAAY,IAAI,qBAAqB;GACrC,OAAO,QAAQ,WAAW;EAC5B;EACA,OAAO,mBAAmB,SAAS,KAAK,EAAE,eAAe,EAAE,CAAC,GAAG,MAAM;CACvE,QAAQ;EACN,YAAY,IAAI,WAAW,SAAS,wBAAwB,qBAAqB;EACjF,OAAO,QAAQ,WAAW;CAC5B;AACF;AAEA,SAAgB,eAAe,QAAgB,QAAmC;CAChF,OAAO,YAAY,QAAQ,QAAQ,MAAM;AAC3C;AAEA,SAAgB,eAAe,QAAgB,QAAmC;CAChF,OAAO,YAAY,QAAQ,QAAQ,MAAM;AAC3C;;;ACteA,SAAS,WAAW,MAAc,SAAmC;CACnE,OAAO,OAAO,OAAO;EAAE;EAAM;CAAQ,CAAC;AACxC;AAEA,SAAS,gBAAgB,QAA8B;CACrD,MAAM,YAAY,QAAQ,QAAQ;CAClC,OAAO,OAAO,cAAc,YAAY,OAAO,cAAc,SAAS,KAAK,YAAY,IACnF,YACA;AACN;AAEA,SAAS,aAAa,QAAoC;CACxD,MAAM,eAAkD,OAAO,OAAO,IAAI;CAC1E,KAAK,MAAM,CAAC,MAAM,WAAW,OAAO,QAAQ,OAAO,mBAAmB,GACpE,aAAa,QAAQ,OAAO,OAAO,CAAC,GAAG,MAAM,CAAC;CAEhD,MAAM,SAAS,OAAO,OAAO,EAAE,GAAG,OAAO,OAAO,CAAC;CACjD,OAAO,OAAO,OAAO;EACnB,cAAc,OAAO,OAAO,CAAC,GAAG,OAAO,YAAY,CAAC;EACpD,mBAAmB,OAAO,OAAO,CAAC,GAAG,OAAO,iBAAiB,CAAC;EAC9D,qBAAqB,OAAO,OAAO,CAAC,GAAG,OAAO,mBAAmB,CAAC;EAClE,mBAAmB,OAAO;EAC1B,qBAAqB,OAAO,OAAO,YAAY;EAC/C;CACF,CAAC;AACH;AAEA,SAAS,eAAe,OAAkC;CACxD,IACE,UAAU,QACV,OAAO,UAAU,YACjB,OAAQ,MAAsC,SAAS,YACvD,OAAQ,MAAyC,YAAY,UAE7D,OAAO,WACJ,MAAoC,MACpC,MAAuC,OAC1C;CAEF,OAAO,WACL,qCACA,oDACF;AACF;AAMA,SAAgB,eACd,OACA,SACA,QACa;CACb,MAAM,mBAAmB,mBAAmB,MAAM,MAAM;CACxD,IACE,CAAC,iBAAiB,MAClB,iBAAiB,YAAY,MAAM,UAAU,MAAM,SAAS,uBAAuB,GAEnF,OAAO;CAET,MAAM,cAAc,aAAa,MAAM;CACvC,MAAM,cAAkC,CAAC;CACzC,MAAM,iBAAiB,gBAAgB,WAAW;CAClD,IAAI,UAAU;CACd,MAAM,OAAO,UAAkC;EAC7C,IAAI,SAAS;EACb,IAAI,YAAY,SAAS,IAAI,gBAAgB;GAC3C,YAAY,KAAK,KAAK;GACtB;EACF;EACA,UAAU;EACV,YAAY,KACV,WAAW,2BAA2B,6CAA6C,CACrF;CACF;CACA,MAAM,UAA0B,OAAO,OAAO;EAC5C,QAAQ;EACR,QAAQ,YAAY;EACpB,SAAS,MAAc,SAAiB;GACtC,IAAI,eAAe;IAAE;IAAM;GAAQ,CAAC,CAAC;EACvC;CACF,CAAC;CACD,MAAM,SAAS,QAAQ,MAAM,OAAO,OAAO;CAC3C,IAAI,WAAW,QAAQ,OAAO,WAAW,UACvC,IACE,WAAW,iCAAiC,gDAAgD,CAC9F;MACK,IAAI,OAAO,gBAAgB,KAAA,GAAW;EAC3C,IAAI,CAAC,MAAM,QAAQ,OAAO,WAAW,GACnC,IACE,WACE,iCACA,gDACF,CACF;OAEA,KAAK,MAAM,SAAS,OAAO,aAAa,IAAI,eAAe,KAAK,CAAC;CAErE;CACA,IAAI,YAAY,SAAS,GACvB,OAAO;EAAE,IAAI;EAAO,aAAa,OAAO,OAAO,WAAW;CAAE;CAE9D,IAAI,WAAW,QAAQ,OAAO,WAAW,YAAY,OAAO,UAAU,KAAA,GACpE,OAAO;EACL,IAAI;EACJ,aAAa,OAAO,OAAO,CACzB,WACE,iCACA,wDACF,CACF,CAAC;CACH;CAEF,OAAO,mBAAmB,OAAO,OAAO,WAAW;AACrD;AAGA,MAAa,qBAA+C,OAAO,OAAO,EACxE,MAAM,OAAkB;CACtB,OAAO,MAAM,KAAK,EAAE,OAAO,MAAM,MAAM,IAAI,EAAE,aAAa,MAAM,YAAY;AAC9E,EACF,CAAC;;;AClJD,SAAS,kBAAkB,aAAgE;CACzF,OAAO,OAAO,OAAO;EACnB,QAAQ;EACR,aAAa,OAAO,OAClB,YAAY,KAAK,UAAU,OAAO,OAAO;GAAE,MAAM,MAAM;GAAM,SAAS,MAAM;EAAQ,CAAC,CAAC,CACxF;CACF,CAAC;AACH;AAMA,SAAgB,0BACd,IACA,UACA,SACA,QACe;CACf,OAAO,OAAO,OAAO;EACnB;EACA,MAAM,KAAK,SAA4B;GAErC,MAAM,UAAU,eAAe,MADb,SAAS,OAAO,GACE,SAAS,MAAM;GACnD,IAAI,CAAC,QAAQ,IAAI,OAAO,kBAAkB,QAAQ,WAAW;GAC7D,OAAO,QAAQ;EACjB;CACF,CAAC;AACH"}
+{"version":3,"file":"index.js","names":[],"sources":["../src/source-policy.ts","../src/parse.ts","../src/runtime-source.ts"],"sourcesContent":["import {\n  DEFAULT_COMPILER_LIMITS,\n  type GrantedTransformOp,\n  type GrantedTransformScope,\n  type LayerGrants,\n} from '@burojs/core';\n\nexport type { GrantedTransformOp, GrantedTransformScope };\n\nexport interface SourceLimits {\n  readonly maxBytes: number;\n  readonly maxDeclarations: number;\n  /**\n   * Nesting depth counted from each declaration value and each transform operation value, never\n   * from the layer root; clamped to `MAX_SOURCE_DEPTH`.\n   */\n  readonly maxDepth: number;\n  /** Portable values in the whole layer, envelope included. */\n  readonly maxNodes: number;\n  readonly maxStringLength: number;\n  readonly maxDiagnostics: number;\n}\n\n/**\n * Host-owned authorization and limits for one configuration source (a JSON or\n * YAML document a host loads — not a screen's `with` source). `grants` is\n * what the compiler enforces for every layer parsed under this policy, for\n * every operation, target, reference and backend binding; the parser reads\n * `allowedCapabilities` and `limits`, and refuses the forbidden keys (action,\n * provider, mapper, service, credential, schema, component, attachment and\n * validator values). Every list is an allow-list with no framework default.\n */\nexport interface SourcePolicy {\n  /** What a layer parsed under this policy may do (`LayerGrants` of `@burojs/core`). */\n  readonly grants: LayerGrants;\n  /** Per declaration kind, the named trusted capabilities it may reference. */\n  readonly allowedCapabilities: Readonly<Record<string, readonly string[]>>;\n  readonly limits: SourceLimits;\n}\n\n/** The compiler's portable depth limit, which no host `maxDepth` may exceed. */\nexport const MAX_SOURCE_DEPTH = DEFAULT_COMPILER_LIMITS.maxPortableDepth;\n\n/**\n * Limits sized for a source that carries whole screen trees. Its bytes stay well under the\n * compiler's 1 MB aggregate, which every layer of one compile shares, so one source cannot starve\n * the others; strings stay under the compiler's 16 KiB per string.\n */\nexport const SCREEN_SOURCE_LIMITS: SourceLimits = Object.freeze({\n  maxBytes: 256_000,\n  maxDeclarations: 64,\n  maxDepth: MAX_SOURCE_DEPTH,\n  maxNodes: 5_000,\n  maxStringLength: 4_096,\n  maxDiagnostics: 32,\n});\n","import { normalizeLayerGrants, type LayerInput, type ParsedLayer } from '@burojs/core';\nimport {\n  blacklistedKeyCategory,\n  createParsedLayer,\n  isReservedSegment,\n  scopeRank,\n} from '@burojs/core/internal';\nimport { parseDocument } from 'yaml';\nimport {\n  MAX_SOURCE_DEPTH,\n  type SourceLimits,\n  type SourcePolicy,\n  type GrantedTransformOp,\n} from './source-policy.js';\n\nconst LAYER_KEYS = new Set([\n  'id',\n  'priority',\n  'defaultNamespace',\n  'revision',\n  'declarations',\n  'transforms',\n]);\nconst DECLARATION_KEYS = new Set(['kind', 'ref', 'schemaVersion', 'value']);\nconst TRANSFORM_KEYS = new Set(['id', 'scope', 'select', 'operation']);\nconst SELECTOR_KEYS = new Set(['kinds', 'namespaces', 'layers', 'refs', 'excludeRefs', 'tags']);\nconst OPERATION_KEYS: Readonly<Record<GrantedTransformOp, ReadonlySet<string>>> = {\n  merge: new Set(['op', 'value']),\n  replace: new Set(['op', 'value', 'ifMissing']),\n  disable: new Set(['op', 'reason']),\n  delete: new Set(['op']),\n};\nconst ATTACHMENT_TAG = '@burojs/core/trusted-attachment';\n\nexport interface SourceDiagnostic {\n  readonly code: string;\n  readonly message: string;\n}\n\n/** A parsed layer carries the grants of the policy it was parsed under; publish it as it is. */\nexport type ParseResult =\n  | { readonly ok: true; readonly value: ParsedLayer }\n  | { readonly ok: false; readonly diagnostics: readonly SourceDiagnostic[] };\n\nclass Diagnostics {\n  readonly values: SourceDiagnostic[] = [];\n  private limited = false;\n\n  constructor(private readonly limit: number) {}\n\n  add(code: string): void {\n    if (this.limited) return;\n    if (this.values.length + 1 < this.limit) {\n      this.values.push(Object.freeze({ code, message: messageFor(code) }));\n      return;\n    }\n    this.limited = true;\n    this.values.push(\n      Object.freeze({\n        code: 'source.diagnostic-limit',\n        message: messageFor('source.diagnostic-limit'),\n      }),\n    );\n  }\n}\n\nfunction messageFor(code: string): string {\n  switch (code) {\n    case 'source.invalid-json':\n      return 'The source is not valid JSON.';\n    case 'source.invalid-yaml':\n      return 'The source is not valid YAML.';\n    case 'source.invalid-policy':\n      return 'The source policy is invalid.';\n    case 'source.byte-limit':\n      return 'The source exceeds its byte limit.';\n    case 'source.declaration-limit':\n      return 'The source exceeds its declaration limit.';\n    case 'source.depth-limit':\n      return 'The source exceeds its nesting-depth limit.';\n    case 'source.node-limit':\n      return 'The source exceeds its value-count limit.';\n    case 'source.string-limit':\n      return 'The source contains an overlong string.';\n    case 'source.diagnostic-limit':\n      return 'Additional source diagnostics were omitted.';\n    case 'source.unknown-key':\n      return 'The source contains an unknown key.';\n    case 'source.reserved-key':\n      return 'The source contains a reserved key.';\n    case 'source.accessor':\n      return 'The source must use data properties.';\n    case 'source.cyclic-value':\n      return 'The source must not contain cyclic values.';\n    case 'source.invalid-layer':\n      return 'The source layer is invalid.';\n    case 'source.invalid-declaration':\n      return 'The source declaration is invalid.';\n    case 'source.invalid-transform':\n      return 'The source transform is invalid.';\n    case 'source.forbidden-kind':\n      return 'The source requests a forbidden declaration kind.';\n    case 'source.forbidden-namespace':\n      return 'The source requests a forbidden namespace.';\n    case 'source.forbidden-transform-op':\n      return 'The source requests a forbidden transform operation.';\n    case 'source.forbidden-transform-scope':\n      return 'The source requests a forbidden transform scope.';\n    case 'source.forbidden-capability':\n      return 'The source requests a forbidden capability.';\n    case 'source.forbidden-action':\n      return \"The source requests a forbidden action binding; a resource's flows are written under toolbar.\";\n    case 'source.forbidden-provider':\n      return 'The source requests a forbidden provider binding.';\n    case 'source.forbidden-mapper':\n      return 'The source requests a forbidden mapper binding.';\n    case 'source.forbidden-service':\n      return 'The source requests a forbidden service value.';\n    case 'source.forbidden-credential':\n      return 'The source requests a forbidden credential value.';\n    case 'source.forbidden-schema':\n      return 'The source requests a forbidden schema value.';\n    case 'source.forbidden-component':\n      return 'The source requests a forbidden component value.';\n    case 'source.forbidden-attachment':\n      return 'The source requests a forbidden attachment value.';\n    case 'source.forbidden-validator':\n      return 'The source requests a forbidden validator value.';\n    default:\n      return 'The source is invalid.';\n  }\n}\n\nconst LIMIT_KEYS = [\n  'maxBytes',\n  'maxDeclarations',\n  'maxDepth',\n  'maxNodes',\n  'maxStringLength',\n  'maxDiagnostics',\n] as const;\n\nconst LIMIT_KEY_SET: ReadonlySet<string> = new Set(LIMIT_KEYS);\n\nfunction validLimits(limits: SourceLimits): boolean {\n  return (\n    plainObject(limits) &&\n    Object.keys(limits).every((key) => LIMIT_KEY_SET.has(key)) &&\n    LIMIT_KEYS.every((key) => Number.isSafeInteger(limits[key]) && limits[key] > 0)\n  );\n}\n\nfunction validCapabilities(value: unknown): value is Readonly<Record<string, readonly string[]>> {\n  return (\n    value !== null &&\n    typeof value === 'object' &&\n    !Array.isArray(value) &&\n    Object.values(value).every(\n      (capabilities) =>\n        Array.isArray(capabilities) &&\n        capabilities.every((capability) => typeof capability === 'string'),\n    )\n  );\n}\n\n/** Why the policy's grants are invalid, from `normalizeLayerGrants`, or undefined when they are valid. */\nfunction grantsError(policy: SourcePolicy): string | undefined {\n  try {\n    normalizeLayerGrants(policy.grants);\n    return undefined;\n  } catch (error) {\n    return error instanceof TypeError ? error.message : '';\n  }\n}\n\n/**\n * The `source.invalid-policy` diagnostic for a policy, or undefined when it is valid. A policy is\n * host-authored, so naming its defect leaks nothing from the source.\n */\nfunction policyDiagnostic(policy: SourcePolicy): SourceDiagnostic | undefined {\n  const generic = messageFor('source.invalid-policy');\n  const stray = strayPolicyKey(policy);\n  if (stray !== undefined) {\n    return Object.freeze({\n      code: 'source.invalid-policy',\n      message: `The source policy is invalid: it carries ${stray} at the top level; a policy is { grants, allowedCapabilities, limits }, with every grant field inside grants.`,\n    });\n  }\n  if (!validPolicyShape(policy)) {\n    return Object.freeze({ code: 'source.invalid-policy', message: generic });\n  }\n  const reason = grantsError(policy);\n  if (reason === undefined) return undefined;\n  return Object.freeze({\n    code: 'source.invalid-policy',\n    message: reason === '' ? generic : `The source policy is invalid: ${reason}`,\n  });\n}\n\nconst POLICY_KEYS: ReadonlySet<string> = new Set(['grants', 'allowedCapabilities', 'limits']);\n\n/** The first top-level key a policy may not carry (an old flat grant key), if any. */\nfunction strayPolicyKey(policy: SourcePolicy): string | undefined {\n  return plainObject(policy) ? Object.keys(policy).find((key) => !POLICY_KEYS.has(key)) : undefined;\n}\n\nfunction validPolicyShape(policy: SourcePolicy): boolean {\n  return (\n    plainObject(policy) &&\n    plainObject(policy.grants) &&\n    validCapabilities(policy.allowedCapabilities) &&\n    validLimits(policy.limits)\n  );\n}\n\n/**\n * A frozen deep copy of a valid policy, so a later change to the host's object cannot change what\n * is parsed under it. Throws a `TypeError` carrying the `source.invalid-policy` message when the\n * policy is invalid — the message `parseJsonLayer` would report.\n */\nexport function ownedPolicy(policy: SourcePolicy): SourcePolicy {\n  const invalid = policyDiagnostic(policy);\n  if (invalid !== undefined) throw new TypeError(invalid.message);\n  const capabilities: Record<string, readonly string[]> = Object.create(null);\n  for (const [kind, values] of Object.entries(policy.allowedCapabilities)) {\n    capabilities[kind] = Object.freeze([...values]);\n  }\n  return Object.freeze({\n    grants: normalizeLayerGrants(policy.grants),\n    allowedCapabilities: Object.freeze(capabilities),\n    limits: Object.freeze({ ...policy.limits }),\n  });\n}\n\nfunction failure(diagnostics: Diagnostics): ParseResult {\n  return { ok: false, diagnostics: Object.freeze(diagnostics.values) };\n}\n\nfunction plainObject(value: unknown): value is Record<string, unknown> {\n  if (value === null || typeof value !== 'object' || Array.isArray(value)) return false;\n  const prototype = Object.getPrototypeOf(value);\n  return prototype === Object.prototype || prototype === null;\n}\n\nfunction ownData(value: object, key: string): unknown {\n  const descriptor = Object.getOwnPropertyDescriptor(value, key);\n  return descriptor !== undefined && 'value' in descriptor ? descriptor.value : undefined;\n}\n\nfunction hasData(value: object, key: string): boolean {\n  const descriptor = Object.getOwnPropertyDescriptor(value, key);\n  return descriptor !== undefined && 'value' in descriptor;\n}\n\n/** Where a value sits in a layer: the envelope's parts, or inside a declaration or operation value. */\ntype CloneRole =\n  | 'root'\n  | 'declarations'\n  | 'declaration'\n  | 'transforms'\n  | 'transform'\n  | 'operation'\n  | 'envelope'\n  | 'value';\n\n/** The deepest legitimate envelope value is a selector ref's id, at depth 6 from the root. */\nconst MAX_ENVELOPE_DEPTH = 8;\n\nfunction childRole(role: CloneRole, key: string | undefined): CloneRole {\n  switch (role) {\n    case 'root':\n      return key === 'declarations'\n        ? 'declarations'\n        : key === 'transforms'\n          ? 'transforms'\n          : 'envelope';\n    case 'declarations':\n      return 'declaration';\n    case 'transforms':\n      return 'transform';\n    case 'declaration':\n      return key === 'value' ? 'value' : 'envelope';\n    case 'transform':\n      return key === 'operation' ? 'operation' : 'envelope';\n    case 'operation':\n      return key === 'value' ? 'value' : 'envelope';\n    default:\n      return role;\n  }\n}\n\nfunction clonePortable(value: unknown, limits: SourceLimits, diagnostics: Diagnostics): unknown {\n  const ancestors = new WeakSet<object>();\n  const maxDepth = Math.min(limits.maxDepth, MAX_SOURCE_DEPTH);\n  let nodes = 0;\n  let nodesExceeded = false;\n\n  /** Refuses a container up front when its children alone would pass `maxNodes`. */\n  function overNodeBudget(children: number): boolean {\n    if (children <= limits.maxNodes - nodes) return false;\n    if (!nodesExceeded) diagnostics.add('source.node-limit');\n    nodesExceeded = true;\n    return true;\n  }\n\n  function copy(current: unknown, depth: number, role: CloneRole): unknown {\n    nodes += 1;\n    if (nodes > limits.maxNodes) {\n      if (!nodesExceeded) diagnostics.add('source.node-limit');\n      nodesExceeded = true;\n      return null;\n    }\n    // A declaration value and an operation value count depth from themselves (they start at 0);\n    // the envelope around them has its own fixed bound.\n    if (depth > (role === 'value' ? maxDepth : MAX_ENVELOPE_DEPTH)) {\n      diagnostics.add('source.depth-limit');\n      return null;\n    }\n    if (current === null || typeof current === 'boolean' || typeof current === 'number')\n      return current;\n    if (typeof current === 'string') {\n      if ([...current].length > limits.maxStringLength) diagnostics.add('source.string-limit');\n      return current;\n    }\n    if (typeof current !== 'object') {\n      diagnostics.add('source.invalid-layer');\n      return null;\n    }\n    if (ancestors.has(current)) {\n      diagnostics.add('source.cyclic-value');\n      return null;\n    }\n    ancestors.add(current);\n\n    if (Array.isArray(current)) {\n      const output: unknown[] = [];\n      const length = ownData(current, 'length');\n      const arrayLength =\n        typeof length === 'number' && Number.isSafeInteger(length) && length >= 0\n          ? length\n          : undefined;\n      // Checked before the keys are listed, so a vast array costs nothing to refuse.\n      if (arrayLength !== undefined && overNodeBudget(arrayLength)) {\n        ancestors.delete(current);\n        return null;\n      }\n      for (const key of Reflect.ownKeys(current)) {\n        if (typeof key !== 'string' || (key !== 'length' && !/^(0|[1-9]\\d*)$/u.test(key))) {\n          diagnostics.add('source.invalid-layer');\n          continue;\n        }\n        if (key === 'length') continue;\n        if (!hasData(current, key)) diagnostics.add('source.accessor');\n      }\n      if (arrayLength === undefined) diagnostics.add('source.invalid-layer');\n      else\n        for (let index = 0; index < arrayLength && !nodesExceeded; index += 1) {\n          if (!hasData(current, String(index))) diagnostics.add('source.accessor');\n          output.push(copy(ownData(current, String(index)), depth + 1, childRole(role, undefined)));\n        }\n      ancestors.delete(current);\n      return Object.freeze(output);\n    }\n\n    if (!plainObject(current)) diagnostics.add('source.invalid-layer');\n    const output: Record<string, unknown> = Object.create(null);\n    const keys = Reflect.ownKeys(current);\n    if (overNodeBudget(keys.length)) {\n      ancestors.delete(current);\n      return null;\n    }\n    for (const key of keys) {\n      if (nodesExceeded) break;\n      if (typeof key !== 'string') {\n        diagnostics.add('source.invalid-layer');\n        continue;\n      }\n      if (isReservedSegment(key)) diagnostics.add('source.reserved-key');\n      if ([...key].length > limits.maxStringLength) diagnostics.add('source.string-limit');\n      if (!hasData(current, key)) {\n        diagnostics.add('source.accessor');\n        continue;\n      }\n      const next = childRole(role, key);\n      const nextDepth = next === 'value' && role !== 'value' ? 0 : depth + 1;\n      output[key] = copy(ownData(current, key), nextDepth, next);\n    }\n    ancestors.delete(current);\n    return Object.freeze(output);\n  }\n\n  return copy(value, 0, 'root');\n}\n\nfunction unknownKeys(value: object, allowed: ReadonlySet<string>, diagnostics: Diagnostics): void {\n  for (const key of Object.keys(value))\n    if (!allowed.has(key)) diagnostics.add('source.unknown-key');\n}\n\nfunction allowedNamespace(value: unknown, policy: SourcePolicy, diagnostics: Diagnostics): boolean {\n  if (typeof value !== 'string' || !policy.grants.allowedNamespaces.includes(value)) {\n    diagnostics.add('source.forbidden-namespace');\n    return false;\n  }\n  return true;\n}\n\nfunction namespaceFor(\n  ref: unknown,\n  defaultNamespace: string,\n  diagnostics: Diagnostics,\n): string | undefined {\n  if (typeof ref === 'string') {\n    const separator = ref.indexOf(':');\n    return separator === -1 ? defaultNamespace : ref.slice(0, separator);\n  }\n  if (!plainObject(ref) || !hasData(ref, 'id')) {\n    diagnostics.add('source.invalid-declaration');\n    return undefined;\n  }\n  for (const key of Object.keys(ref))\n    if (key !== 'id' && key !== 'namespace') diagnostics.add('source.unknown-key');\n  const namespace = hasData(ref, 'namespace') ? ownData(ref, 'namespace') : defaultNamespace;\n  if (typeof namespace !== 'string') diagnostics.add('source.invalid-declaration');\n  return typeof namespace === 'string' ? namespace : undefined;\n}\n\nfunction validateValue(\n  value: unknown,\n  kind: string,\n  policy: SourcePolicy,\n  diagnostics: Diagnostics,\n): void {\n  if (value === null || typeof value !== 'object') return;\n  if (Array.isArray(value)) {\n    for (const item of value) validateValue(item, kind, policy, diagnostics);\n    return;\n  }\n  if (!plainObject(value)) return;\n  if (value.$buro === ATTACHMENT_TAG) {\n    const capability = ownData(value, 'capability');\n    // An own entry only: a kind named like an Object.prototype member reaches no inherited value.\n    const allowed = Object.hasOwn(policy.allowedCapabilities, kind)\n      ? policy.allowedCapabilities[kind]\n      : undefined;\n    if (typeof capability !== 'string' || !allowed?.includes(capability)) {\n      diagnostics.add('source.forbidden-capability');\n    }\n  }\n  for (const key of Object.keys(value)) {\n    const category = blacklistedKeyCategory(key);\n    if (category !== undefined) diagnostics.add(`source.forbidden-${category}`);\n    validateValue(ownData(value, key), kind, policy, diagnostics);\n  }\n}\n\nfunction transformOperation(value: unknown): GrantedTransformOp | undefined {\n  if (!plainObject(value)) return undefined;\n  const operation = ownData(value, 'op');\n  return operation === 'merge' ||\n    operation === 'replace' ||\n    operation === 'disable' ||\n    operation === 'delete'\n    ? operation\n    : undefined;\n}\n\nfunction validateSelectorRefs(\n  value: unknown,\n  defaultNamespace: string,\n  policy: SourcePolicy,\n  diagnostics: Diagnostics,\n): void {\n  if (value === undefined) return;\n  if (!Array.isArray(value)) {\n    diagnostics.add('source.invalid-transform');\n    return;\n  }\n  for (const ref of value) {\n    const namespace = namespaceFor(ref, defaultNamespace, diagnostics);\n    if (namespace !== undefined) allowedNamespace(namespace, policy, diagnostics);\n  }\n}\n\nfunction validateTransforms(\n  value: unknown,\n  defaultNamespace: string,\n  policy: SourcePolicy,\n  diagnostics: Diagnostics,\n): void {\n  if (value === undefined) return;\n  if (!Array.isArray(value)) {\n    diagnostics.add('source.invalid-transform');\n    return;\n  }\n  for (const transform of value) {\n    if (!plainObject(transform)) {\n      diagnostics.add('source.invalid-transform');\n      continue;\n    }\n    unknownKeys(transform, TRANSFORM_KEYS, diagnostics);\n    const scope = ownData(transform, 'scope') ?? 'layer';\n    if (scope !== 'layer' && scope !== 'application') diagnostics.add('source.invalid-transform');\n    else if (scopeRank(scope) > scopeRank(policy.grants.maxTransformScope))\n      diagnostics.add('source.forbidden-transform-scope');\n    const select = ownData(transform, 'select');\n    if (!plainObject(select)) diagnostics.add('source.invalid-transform');\n    else {\n      unknownKeys(select, SELECTOR_KEYS, diagnostics);\n      const selectedKinds = ownData(select, 'kinds');\n      if (selectedKinds !== undefined) {\n        if (!Array.isArray(selectedKinds)) diagnostics.add('source.invalid-transform');\n        else\n          for (const kind of selectedKinds) {\n            if (typeof kind !== 'string') diagnostics.add('source.invalid-transform');\n            else if (!policy.grants.allowedKinds.includes(kind))\n              diagnostics.add('source.forbidden-kind');\n          }\n      }\n      const selectedNamespaces = ownData(select, 'namespaces');\n      if (selectedNamespaces !== undefined) {\n        if (!Array.isArray(selectedNamespaces)) diagnostics.add('source.invalid-transform');\n        else\n          for (const namespace of selectedNamespaces)\n            allowedNamespace(namespace, policy, diagnostics);\n      }\n      validateSelectorRefs(ownData(select, 'refs'), defaultNamespace, policy, diagnostics);\n      validateSelectorRefs(ownData(select, 'excludeRefs'), defaultNamespace, policy, diagnostics);\n    }\n    const operation = ownData(transform, 'operation');\n    const op = transformOperation(operation);\n    const rawOp = plainObject(operation) ? ownData(operation, 'op') : undefined;\n    if (typeof rawOp === 'string' && op === undefined)\n      diagnostics.add('source.forbidden-transform-op');\n    else if (op === undefined) diagnostics.add('source.invalid-transform');\n    else {\n      if (!policy.grants.allowedTransformOps.includes(op))\n        diagnostics.add('source.forbidden-transform-op');\n      if (plainObject(operation)) {\n        unknownKeys(operation, OPERATION_KEYS[op], diagnostics);\n        if (hasData(operation, 'value'))\n          validateValue(ownData(operation, 'value'), '', policy, diagnostics);\n      }\n    }\n  }\n}\n\n/** Validates and clones a parser-produced value without retaining source-owned object references. */\nexport function validateLayerValue(value: unknown, policy: SourcePolicy): ParseResult {\n  const invalidPolicy = policyDiagnostic(policy);\n  if (invalidPolicy !== undefined) {\n    return { ok: false, diagnostics: Object.freeze([invalidPolicy]) };\n  }\n  const diagnostics = new Diagnostics(policy.limits.maxDiagnostics);\n  const cloned = clonePortable(value, policy.limits, diagnostics);\n  if (diagnostics.values.length > 0) return failure(diagnostics);\n  if (!plainObject(cloned)) {\n    diagnostics.add('source.invalid-layer');\n    return failure(diagnostics);\n  }\n  unknownKeys(cloned, LAYER_KEYS, diagnostics);\n  const id = ownData(cloned, 'id');\n  const priority = ownData(cloned, 'priority');\n  const declarations = ownData(cloned, 'declarations');\n  if (typeof id !== 'string' || !Number.isSafeInteger(priority) || !Array.isArray(declarations)) {\n    diagnostics.add('source.invalid-layer');\n    return failure(diagnostics);\n  }\n  if (declarations.length > policy.limits.maxDeclarations)\n    diagnostics.add('source.declaration-limit');\n  const rawDefaultNamespace = ownData(cloned, 'defaultNamespace');\n  const defaultNamespace = rawDefaultNamespace === undefined ? 'default' : rawDefaultNamespace;\n  if (typeof defaultNamespace !== 'string') diagnostics.add('source.invalid-layer');\n  else allowedNamespace(defaultNamespace, policy, diagnostics);\n  for (const declaration of declarations) {\n    if (!plainObject(declaration)) {\n      diagnostics.add('source.invalid-declaration');\n      continue;\n    }\n    unknownKeys(declaration, DECLARATION_KEYS, diagnostics);\n    const kind = ownData(declaration, 'kind');\n    if (typeof kind !== 'string') diagnostics.add('source.invalid-declaration');\n    else if (!policy.grants.allowedKinds.includes(kind)) diagnostics.add('source.forbidden-kind');\n    const namespace = namespaceFor(\n      ownData(declaration, 'ref'),\n      typeof defaultNamespace === 'string' ? defaultNamespace : 'default',\n      diagnostics,\n    );\n    if (namespace !== undefined) allowedNamespace(namespace, policy, diagnostics);\n    if (\n      !Number.isSafeInteger(ownData(declaration, 'schemaVersion')) ||\n      !hasData(declaration, 'value')\n    ) {\n      diagnostics.add('source.invalid-declaration');\n    }\n    if (typeof kind === 'string' && hasData(declaration, 'value')) {\n      validateValue(ownData(declaration, 'value'), kind, policy, diagnostics);\n    }\n  }\n  validateTransforms(\n    ownData(cloned, 'transforms'),\n    typeof defaultNamespace === 'string' ? defaultNamespace : 'default',\n    policy,\n    diagnostics,\n  );\n  if (diagnostics.values.length > 0) return failure(diagnostics);\n  return {\n    ok: true,\n    value: createParsedLayer(cloned as unknown as LayerInput, normalizeLayerGrants(policy.grants)),\n  };\n}\n\nfunction byteLength(value: string): number {\n  return new TextEncoder().encode(value).byteLength;\n}\n\nfunction parseSource(source: string, policy: SourcePolicy, format: 'json' | 'yaml'): ParseResult {\n  if (policyDiagnostic(policy) !== undefined) return validateLayerValue(null, policy);\n  const diagnostics = new Diagnostics(policy.limits.maxDiagnostics);\n  if (byteLength(source) > policy.limits.maxBytes) {\n    diagnostics.add('source.byte-limit');\n    return failure(diagnostics);\n  }\n  try {\n    if (format === 'json') return validateLayerValue(JSON.parse(source), policy);\n    const document = parseDocument(source, { prettyErrors: false, strict: true, uniqueKeys: true });\n    if (document.errors.length > 0) {\n      diagnostics.add('source.invalid-yaml');\n      return failure(diagnostics);\n    }\n    return validateLayerValue(document.toJS({ maxAliasCount: 0 }), policy);\n  } catch {\n    diagnostics.add(format === 'json' ? 'source.invalid-json' : 'source.invalid-yaml');\n    return failure(diagnostics);\n  }\n}\n\nexport function parseJsonLayer(source: string, policy: SourcePolicy): ParseResult {\n  return parseSource(source, policy, 'json');\n}\n\nexport function parseYamlLayer(source: string, policy: SourcePolicy): ParseResult {\n  return parseSource(source, policy, 'yaml');\n}\n","import type {\n  LayerGrants,\n  RuntimeSource,\n  RuntimeSourceFailure,\n  SourceLoadContext,\n} from '@burojs/core';\nimport { ownedPolicy, parseJsonLayer, parseYamlLayer, type SourceDiagnostic } from './parse.js';\nimport type { SourcePolicy } from './source-policy.js';\n\n/** The text a configuration source loads, and its format. */\nexport interface ConfigSourceText {\n  readonly format: 'json' | 'yaml';\n  readonly text: string;\n}\n\nexport interface ConfigRuntimeSourceOptions {\n  /** The policy every load is parsed under; passed once. */\n  readonly policy: SourcePolicy;\n  readonly load: (context: SourceLoadContext) => Promise<ConfigSourceText>;\n}\n\n/** A runtime source and the trust to register it with. */\nexport interface ConfigRuntimeSource {\n  readonly source: RuntimeSource;\n  /** The policy's grants. A host may register a narrower trust; the runtime checks each layer against both. */\n  readonly trust: LayerGrants;\n}\n\nconst INVALID_FORMAT: SourceDiagnostic = Object.freeze({\n  code: 'source.invalid-format',\n  message: 'The source format must be json or yaml.',\n});\n\nfunction rejection(diagnostics: readonly SourceDiagnostic[]): RuntimeSourceFailure {\n  return Object.freeze({\n    status: 'rejected',\n    diagnostics: Object.freeze(\n      diagnostics.map((entry) => Object.freeze({ code: entry.code, message: entry.message })),\n    ),\n  });\n}\n\n/**\n * A layer-runtime source (what `LayerRuntime.registerSource` takes — not a\n * screen's `with` source) for one configuration document: each load fetches\n * its text and parses it under `policy`, so the policy is passed once. The\n * policy is validated and copied here: an invalid one throws a `TypeError`\n * with the parser's `source.invalid-policy` message, and a later change to the\n * host's object changes nothing. Register it with\n * `runtime.registerSource(configured.source, configured.trust)`.\n * Publication, cancellation, epochs and commits stay `LayerRuntime`'s.\n */\nexport function createConfigRuntimeSource(\n  id: string,\n  options: ConfigRuntimeSourceOptions,\n): ConfigRuntimeSource {\n  const policy = ownedPolicy(options.policy);\n  const { load } = options;\n  const source: RuntimeSource = Object.freeze({\n    id,\n    async load(context: SourceLoadContext) {\n      const raw = await load(context);\n      const parsed =\n        raw.format === 'json'\n          ? parseJsonLayer(raw.text, policy)\n          : raw.format === 'yaml'\n            ? parseYamlLayer(raw.text, policy)\n            : undefined;\n      if (parsed === undefined) return rejection([INVALID_FORMAT]);\n      return parsed.ok ? parsed.value : rejection(parsed.diagnostics);\n    },\n  });\n  return Object.freeze({ source, trust: policy.grants });\n}\n"],"mappings":";;;;AAyCA,MAAa,mBAAmB,wBAAwB;AAOxD,MAAa,uBAAqC,OAAO,OAAO;CAC9D,UAAU;CACV,iBAAiB;CACjB,UAAU;CACV,UAAU;CACV,iBAAiB;CACjB,gBAAgB;AAClB,CAAC;;;ACxCD,MAAM,aAAa,IAAI,IAAI;CACzB;CACA;CACA;CACA;CACA;CACA;AACF,CAAC;AACD,MAAM,mBAAmB,IAAI,IAAI;CAAC;CAAQ;CAAO;CAAiB;AAAO,CAAC;AAC1E,MAAM,iBAAiB,IAAI,IAAI;CAAC;CAAM;CAAS;CAAU;AAAW,CAAC;AACrE,MAAM,gBAAgB,IAAI,IAAI;CAAC;CAAS;CAAc;CAAU;CAAQ;CAAe;AAAM,CAAC;AAC9F,MAAM,iBAA4E;CAChF,OAAO,IAAI,IAAI,CAAC,MAAM,OAAO,CAAC;CAC9B,SAAS,IAAI,IAAI;EAAC;EAAM;EAAS;CAAW,CAAC;CAC7C,SAAS,IAAI,IAAI,CAAC,MAAM,QAAQ,CAAC;CACjC,QAAQ,IAAI,IAAI,CAAC,IAAI,CAAC;AACxB;AACA,MAAM,iBAAiB;AAYvB,IAAM,cAAN,MAAkB;CAIa;CAH7B,SAAsC,CAAC;CACvC,UAAkB;CAElB,YAAY,OAAgC;EAAf,KAAA,QAAA;CAAgB;CAE7C,IAAI,MAAoB;EACtB,IAAI,KAAK,SAAS;EAClB,IAAI,KAAK,OAAO,SAAS,IAAI,KAAK,OAAO;GACvC,KAAK,OAAO,KAAK,OAAO,OAAO;IAAE;IAAM,SAAS,WAAW,IAAI;GAAE,CAAC,CAAC;GACnE;EACF;EACA,KAAK,UAAU;EACf,KAAK,OAAO,KACV,OAAO,OAAO;GACZ,MAAM;GACN,SAAS,WAAW,yBAAyB;EAC/C,CAAC,CACH;CACF;AACF;AAEA,SAAS,WAAW,MAAsB;CACxC,QAAQ,MAAR;EACE,KAAK,uBACH,OAAO;EACT,KAAK,uBACH,OAAO;EACT,KAAK,yBACH,OAAO;EACT,KAAK,qBACH,OAAO;EACT,KAAK,4BACH,OAAO;EACT,KAAK,sBACH,OAAO;EACT,KAAK,qBACH,OAAO;EACT,KAAK,uBACH,OAAO;EACT,KAAK,2BACH,OAAO;EACT,KAAK,sBACH,OAAO;EACT,KAAK,uBACH,OAAO;EACT,KAAK,mBACH,OAAO;EACT,KAAK,uBACH,OAAO;EACT,KAAK,wBACH,OAAO;EACT,KAAK,8BACH,OAAO;EACT,KAAK,4BACH,OAAO;EACT,KAAK,yBACH,OAAO;EACT,KAAK,8BACH,OAAO;EACT,KAAK,iCACH,OAAO;EACT,KAAK,oCACH,OAAO;EACT,KAAK,+BACH,OAAO;EACT,KAAK,2BACH,OAAO;EACT,KAAK,6BACH,OAAO;EACT,KAAK,2BACH,OAAO;EACT,KAAK,4BACH,OAAO;EACT,KAAK,+BACH,OAAO;EACT,KAAK,2BACH,OAAO;EACT,KAAK,8BACH,OAAO;EACT,KAAK,+BACH,OAAO;EACT,KAAK,8BACH,OAAO;EACT,SACE,OAAO;CACX;AACF;AAEA,MAAM,aAAa;CACjB;CACA;CACA;CACA;CACA;CACA;AACF;AAEA,MAAM,gBAAqC,IAAI,IAAI,UAAU;AAE7D,SAAS,YAAY,QAA+B;CAClD,OACE,YAAY,MAAM,KAClB,OAAO,KAAK,MAAM,CAAC,CAAC,OAAO,QAAQ,cAAc,IAAI,GAAG,CAAC,KACzD,WAAW,OAAO,QAAQ,OAAO,cAAc,OAAO,IAAI,KAAK,OAAO,OAAO,CAAC;AAElF;AAEA,SAAS,kBAAkB,OAAsE;CAC/F,OACE,UAAU,QACV,OAAO,UAAU,YACjB,CAAC,MAAM,QAAQ,KAAK,KACpB,OAAO,OAAO,KAAK,CAAC,CAAC,OAClB,iBACC,MAAM,QAAQ,YAAY,KAC1B,aAAa,OAAO,eAAe,OAAO,eAAe,QAAQ,CACrE;AAEJ;AAGA,SAAS,YAAY,QAA0C;CAC7D,IAAI;EACF,qBAAqB,OAAO,MAAM;EAClC;CACF,SAAS,OAAO;EACd,OAAO,iBAAiB,YAAY,MAAM,UAAU;CACtD;AACF;AAMA,SAAS,iBAAiB,QAAoD;CAC5E,MAAM,UAAU,WAAW,uBAAuB;CAClD,MAAM,QAAQ,eAAe,MAAM;CACnC,IAAI,UAAU,KAAA,GACZ,OAAO,OAAO,OAAO;EACnB,MAAM;EACN,SAAS,4CAA4C,MAAM;CAC7D,CAAC;CAEH,IAAI,CAAC,iBAAiB,MAAM,GAC1B,OAAO,OAAO,OAAO;EAAE,MAAM;EAAyB,SAAS;CAAQ,CAAC;CAE1E,MAAM,SAAS,YAAY,MAAM;CACjC,IAAI,WAAW,KAAA,GAAW,OAAO,KAAA;CACjC,OAAO,OAAO,OAAO;EACnB,MAAM;EACN,SAAS,WAAW,KAAK,UAAU,iCAAiC;CACtE,CAAC;AACH;AAEA,MAAM,cAAmC,IAAI,IAAI;CAAC;CAAU;CAAuB;AAAQ,CAAC;AAG5F,SAAS,eAAe,QAA0C;CAChE,OAAO,YAAY,MAAM,IAAI,OAAO,KAAK,MAAM,CAAC,CAAC,MAAM,QAAQ,CAAC,YAAY,IAAI,GAAG,CAAC,IAAI,KAAA;AAC1F;AAEA,SAAS,iBAAiB,QAA+B;CACvD,OACE,YAAY,MAAM,KAClB,YAAY,OAAO,MAAM,KACzB,kBAAkB,OAAO,mBAAmB,KAC5C,YAAY,OAAO,MAAM;AAE7B;AAOA,SAAgB,YAAY,QAAoC;CAC9D,MAAM,UAAU,iBAAiB,MAAM;CACvC,IAAI,YAAY,KAAA,GAAW,MAAM,IAAI,UAAU,QAAQ,OAAO;CAC9D,MAAM,eAAkD,OAAO,OAAO,IAAI;CAC1E,KAAK,MAAM,CAAC,MAAM,WAAW,OAAO,QAAQ,OAAO,mBAAmB,GACpE,aAAa,QAAQ,OAAO,OAAO,CAAC,GAAG,MAAM,CAAC;CAEhD,OAAO,OAAO,OAAO;EACnB,QAAQ,qBAAqB,OAAO,MAAM;EAC1C,qBAAqB,OAAO,OAAO,YAAY;EAC/C,QAAQ,OAAO,OAAO,EAAE,GAAG,OAAO,OAAO,CAAC;CAC5C,CAAC;AACH;AAEA,SAAS,QAAQ,aAAuC;CACtD,OAAO;EAAE,IAAI;EAAO,aAAa,OAAO,OAAO,YAAY,MAAM;CAAE;AACrE;AAEA,SAAS,YAAY,OAAkD;CACrE,IAAI,UAAU,QAAQ,OAAO,UAAU,YAAY,MAAM,QAAQ,KAAK,GAAG,OAAO;CAChF,MAAM,YAAY,OAAO,eAAe,KAAK;CAC7C,OAAO,cAAc,OAAO,aAAa,cAAc;AACzD;AAEA,SAAS,QAAQ,OAAe,KAAsB;CACpD,MAAM,aAAa,OAAO,yBAAyB,OAAO,GAAG;CAC7D,OAAO,eAAe,KAAA,KAAa,WAAW,aAAa,WAAW,QAAQ,KAAA;AAChF;AAEA,SAAS,QAAQ,OAAe,KAAsB;CACpD,MAAM,aAAa,OAAO,yBAAyB,OAAO,GAAG;CAC7D,OAAO,eAAe,KAAA,KAAa,WAAW;AAChD;AAcA,MAAM,qBAAqB;AAE3B,SAAS,UAAU,MAAiB,KAAoC;CACtE,QAAQ,MAAR;EACE,KAAK,QACH,OAAO,QAAQ,iBACX,iBACA,QAAQ,eACN,eACA;EACR,KAAK,gBACH,OAAO;EACT,KAAK,cACH,OAAO;EACT,KAAK,eACH,OAAO,QAAQ,UAAU,UAAU;EACrC,KAAK,aACH,OAAO,QAAQ,cAAc,cAAc;EAC7C,KAAK,aACH,OAAO,QAAQ,UAAU,UAAU;EACrC,SACE,OAAO;CACX;AACF;AAEA,SAAS,cAAc,OAAgB,QAAsB,aAAmC;CAC9F,MAAM,YAAY,IAAI,QAAgB;CACtC,MAAM,WAAW,KAAK,IAAI,OAAO,UAAU,gBAAgB;CAC3D,IAAI,QAAQ;CACZ,IAAI,gBAAgB;CAGpB,SAAS,eAAe,UAA2B;EACjD,IAAI,YAAY,OAAO,WAAW,OAAO,OAAO;EAChD,IAAI,CAAC,eAAe,YAAY,IAAI,mBAAmB;EACvD,gBAAgB;EAChB,OAAO;CACT;CAEA,SAAS,KAAK,SAAkB,OAAe,MAA0B;EACvE,SAAS;EACT,IAAI,QAAQ,OAAO,UAAU;GAC3B,IAAI,CAAC,eAAe,YAAY,IAAI,mBAAmB;GACvD,gBAAgB;GAChB,OAAO;EACT;EAGA,IAAI,SAAS,SAAS,UAAU,WAAW,qBAAqB;GAC9D,YAAY,IAAI,oBAAoB;GACpC,OAAO;EACT;EACA,IAAI,YAAY,QAAQ,OAAO,YAAY,aAAa,OAAO,YAAY,UACzE,OAAO;EACT,IAAI,OAAO,YAAY,UAAU;GAC/B,IAAI,CAAC,GAAG,OAAO,CAAC,CAAC,SAAS,OAAO,iBAAiB,YAAY,IAAI,qBAAqB;GACvF,OAAO;EACT;EACA,IAAI,OAAO,YAAY,UAAU;GAC/B,YAAY,IAAI,sBAAsB;GACtC,OAAO;EACT;EACA,IAAI,UAAU,IAAI,OAAO,GAAG;GAC1B,YAAY,IAAI,qBAAqB;GACrC,OAAO;EACT;EACA,UAAU,IAAI,OAAO;EAErB,IAAI,MAAM,QAAQ,OAAO,GAAG;GAC1B,MAAM,SAAoB,CAAC;GAC3B,MAAM,SAAS,QAAQ,SAAS,QAAQ;GACxC,MAAM,cACJ,OAAO,WAAW,YAAY,OAAO,cAAc,MAAM,KAAK,UAAU,IACpE,SACA,KAAA;GAEN,IAAI,gBAAgB,KAAA,KAAa,eAAe,WAAW,GAAG;IAC5D,UAAU,OAAO,OAAO;IACxB,OAAO;GACT;GACA,KAAK,MAAM,OAAO,QAAQ,QAAQ,OAAO,GAAG;IAC1C,IAAI,OAAO,QAAQ,YAAa,QAAQ,YAAY,CAAC,kBAAkB,KAAK,GAAG,GAAI;KACjF,YAAY,IAAI,sBAAsB;KACtC;IACF;IACA,IAAI,QAAQ,UAAU;IACtB,IAAI,CAAC,QAAQ,SAAS,GAAG,GAAG,YAAY,IAAI,iBAAiB;GAC/D;GACA,IAAI,gBAAgB,KAAA,GAAW,YAAY,IAAI,sBAAsB;QAEnE,KAAK,IAAI,QAAQ,GAAG,QAAQ,eAAe,CAAC,eAAe,SAAS,GAAG;IACrE,IAAI,CAAC,QAAQ,SAAS,OAAO,KAAK,CAAC,GAAG,YAAY,IAAI,iBAAiB;IACvE,OAAO,KAAK,KAAK,QAAQ,SAAS,OAAO,KAAK,CAAC,GAAG,QAAQ,GAAG,UAAU,MAAM,KAAA,CAAS,CAAC,CAAC;GAC1F;GACF,UAAU,OAAO,OAAO;GACxB,OAAO,OAAO,OAAO,MAAM;EAC7B;EAEA,IAAI,CAAC,YAAY,OAAO,GAAG,YAAY,IAAI,sBAAsB;EACjE,MAAM,SAAkC,OAAO,OAAO,IAAI;EAC1D,MAAM,OAAO,QAAQ,QAAQ,OAAO;EACpC,IAAI,eAAe,KAAK,MAAM,GAAG;GAC/B,UAAU,OAAO,OAAO;GACxB,OAAO;EACT;EACA,KAAK,MAAM,OAAO,MAAM;GACtB,IAAI,eAAe;GACnB,IAAI,OAAO,QAAQ,UAAU;IAC3B,YAAY,IAAI,sBAAsB;IACtC;GACF;GACA,IAAI,kBAAkB,GAAG,GAAG,YAAY,IAAI,qBAAqB;GACjE,IAAI,CAAC,GAAG,GAAG,CAAC,CAAC,SAAS,OAAO,iBAAiB,YAAY,IAAI,qBAAqB;GACnF,IAAI,CAAC,QAAQ,SAAS,GAAG,GAAG;IAC1B,YAAY,IAAI,iBAAiB;IACjC;GACF;GACA,MAAM,OAAO,UAAU,MAAM,GAAG;GAChC,MAAM,YAAY,SAAS,WAAW,SAAS,UAAU,IAAI,QAAQ;GACrE,OAAO,OAAO,KAAK,QAAQ,SAAS,GAAG,GAAG,WAAW,IAAI;EAC3D;EACA,UAAU,OAAO,OAAO;EACxB,OAAO,OAAO,OAAO,MAAM;CAC7B;CAEA,OAAO,KAAK,OAAO,GAAG,MAAM;AAC9B;AAEA,SAAS,YAAY,OAAe,SAA8B,aAAgC;CAChG,KAAK,MAAM,OAAO,OAAO,KAAK,KAAK,GACjC,IAAI,CAAC,QAAQ,IAAI,GAAG,GAAG,YAAY,IAAI,oBAAoB;AAC/D;AAEA,SAAS,iBAAiB,OAAgB,QAAsB,aAAmC;CACjG,IAAI,OAAO,UAAU,YAAY,CAAC,OAAO,OAAO,kBAAkB,SAAS,KAAK,GAAG;EACjF,YAAY,IAAI,4BAA4B;EAC5C,OAAO;CACT;CACA,OAAO;AACT;AAEA,SAAS,aACP,KACA,kBACA,aACoB;CACpB,IAAI,OAAO,QAAQ,UAAU;EAC3B,MAAM,YAAY,IAAI,QAAQ,GAAG;EACjC,OAAO,cAAc,KAAK,mBAAmB,IAAI,MAAM,GAAG,SAAS;CACrE;CACA,IAAI,CAAC,YAAY,GAAG,KAAK,CAAC,QAAQ,KAAK,IAAI,GAAG;EAC5C,YAAY,IAAI,4BAA4B;EAC5C;CACF;CACA,KAAK,MAAM,OAAO,OAAO,KAAK,GAAG,GAC/B,IAAI,QAAQ,QAAQ,QAAQ,aAAa,YAAY,IAAI,oBAAoB;CAC/E,MAAM,YAAY,QAAQ,KAAK,WAAW,IAAI,QAAQ,KAAK,WAAW,IAAI;CAC1E,IAAI,OAAO,cAAc,UAAU,YAAY,IAAI,4BAA4B;CAC/E,OAAO,OAAO,cAAc,WAAW,YAAY,KAAA;AACrD;AAEA,SAAS,cACP,OACA,MACA,QACA,aACM;CACN,IAAI,UAAU,QAAQ,OAAO,UAAU,UAAU;CACjD,IAAI,MAAM,QAAQ,KAAK,GAAG;EACxB,KAAK,MAAM,QAAQ,OAAO,cAAc,MAAM,MAAM,QAAQ,WAAW;EACvE;CACF;CACA,IAAI,CAAC,YAAY,KAAK,GAAG;CACzB,IAAI,MAAM,UAAU,gBAAgB;EAClC,MAAM,aAAa,QAAQ,OAAO,YAAY;EAE9C,MAAM,UAAU,OAAO,OAAO,OAAO,qBAAqB,IAAI,IAC1D,OAAO,oBAAoB,QAC3B,KAAA;EACJ,IAAI,OAAO,eAAe,YAAY,CAAC,SAAS,SAAS,UAAU,GACjE,YAAY,IAAI,6BAA6B;CAEjD;CACA,KAAK,MAAM,OAAO,OAAO,KAAK,KAAK,GAAG;EACpC,MAAM,WAAW,uBAAuB,GAAG;EAC3C,IAAI,aAAa,KAAA,GAAW,YAAY,IAAI,oBAAoB,UAAU;EAC1E,cAAc,QAAQ,OAAO,GAAG,GAAG,MAAM,QAAQ,WAAW;CAC9D;AACF;AAEA,SAAS,mBAAmB,OAAgD;CAC1E,IAAI,CAAC,YAAY,KAAK,GAAG,OAAO,KAAA;CAChC,MAAM,YAAY,QAAQ,OAAO,IAAI;CACrC,OAAO,cAAc,WACnB,cAAc,aACd,cAAc,aACd,cAAc,WACZ,YACA,KAAA;AACN;AAEA,SAAS,qBACP,OACA,kBACA,QACA,aACM;CACN,IAAI,UAAU,KAAA,GAAW;CACzB,IAAI,CAAC,MAAM,QAAQ,KAAK,GAAG;EACzB,YAAY,IAAI,0BAA0B;EAC1C;CACF;CACA,KAAK,MAAM,OAAO,OAAO;EACvB,MAAM,YAAY,aAAa,KAAK,kBAAkB,WAAW;EACjE,IAAI,cAAc,KAAA,GAAW,iBAAiB,WAAW,QAAQ,WAAW;CAC9E;AACF;AAEA,SAAS,mBACP,OACA,kBACA,QACA,aACM;CACN,IAAI,UAAU,KAAA,GAAW;CACzB,IAAI,CAAC,MAAM,QAAQ,KAAK,GAAG;EACzB,YAAY,IAAI,0BAA0B;EAC1C;CACF;CACA,KAAK,MAAM,aAAa,OAAO;EAC7B,IAAI,CAAC,YAAY,SAAS,GAAG;GAC3B,YAAY,IAAI,0BAA0B;GAC1C;EACF;EACA,YAAY,WAAW,gBAAgB,WAAW;EAClD,MAAM,QAAQ,QAAQ,WAAW,OAAO,KAAK;EAC7C,IAAI,UAAU,WAAW,UAAU,eAAe,YAAY,IAAI,0BAA0B;OACvF,IAAI,UAAU,KAAK,IAAI,UAAU,OAAO,OAAO,iBAAiB,GACnE,YAAY,IAAI,kCAAkC;EACpD,MAAM,SAAS,QAAQ,WAAW,QAAQ;EAC1C,IAAI,CAAC,YAAY,MAAM,GAAG,YAAY,IAAI,0BAA0B;OAC/D;GACH,YAAY,QAAQ,eAAe,WAAW;GAC9C,MAAM,gBAAgB,QAAQ,QAAQ,OAAO;GAC7C,IAAI,kBAAkB,KAAA,GAAW;IAC/B,IAAI,CAAC,MAAM,QAAQ,aAAa,GAAG,YAAY,IAAI,0BAA0B;SAE3E,KAAK,MAAM,QAAQ,eACjB,IAAI,OAAO,SAAS,UAAU,YAAY,IAAI,0BAA0B;SACnE,IAAI,CAAC,OAAO,OAAO,aAAa,SAAS,IAAI,GAChD,YAAY,IAAI,uBAAuB;GAE/C;GACA,MAAM,qBAAqB,QAAQ,QAAQ,YAAY;GACvD,IAAI,uBAAuB,KAAA,GAAW;IACpC,IAAI,CAAC,MAAM,QAAQ,kBAAkB,GAAG,YAAY,IAAI,0BAA0B;SAEhF,KAAK,MAAM,aAAa,oBACtB,iBAAiB,WAAW,QAAQ,WAAW;GACrD;GACA,qBAAqB,QAAQ,QAAQ,MAAM,GAAG,kBAAkB,QAAQ,WAAW;GACnF,qBAAqB,QAAQ,QAAQ,aAAa,GAAG,kBAAkB,QAAQ,WAAW;EAC5F;EACA,MAAM,YAAY,QAAQ,WAAW,WAAW;EAChD,MAAM,KAAK,mBAAmB,SAAS;EAEvC,IAAI,QADU,YAAY,SAAS,IAAI,QAAQ,WAAW,IAAI,IAAI,KAAA,OAC7C,YAAY,OAAO,KAAA,GACtC,YAAY,IAAI,+BAA+B;OAC5C,IAAI,OAAO,KAAA,GAAW,YAAY,IAAI,0BAA0B;OAChE;GACH,IAAI,CAAC,OAAO,OAAO,oBAAoB,SAAS,EAAE,GAChD,YAAY,IAAI,+BAA+B;GACjD,IAAI,YAAY,SAAS,GAAG;IAC1B,YAAY,WAAW,eAAe,KAAK,WAAW;IACtD,IAAI,QAAQ,WAAW,OAAO,GAC5B,cAAc,QAAQ,WAAW,OAAO,GAAG,IAAI,QAAQ,WAAW;GACtE;EACF;CACF;AACF;AAGA,SAAgB,mBAAmB,OAAgB,QAAmC;CACpF,MAAM,gBAAgB,iBAAiB,MAAM;CAC7C,IAAI,kBAAkB,KAAA,GACpB,OAAO;EAAE,IAAI;EAAO,aAAa,OAAO,OAAO,CAAC,aAAa,CAAC;CAAE;CAElE,MAAM,cAAc,IAAI,YAAY,OAAO,OAAO,cAAc;CAChE,MAAM,SAAS,cAAc,OAAO,OAAO,QAAQ,WAAW;CAC9D,IAAI,YAAY,OAAO,SAAS,GAAG,OAAO,QAAQ,WAAW;CAC7D,IAAI,CAAC,YAAY,MAAM,GAAG;EACxB,YAAY,IAAI,sBAAsB;EACtC,OAAO,QAAQ,WAAW;CAC5B;CACA,YAAY,QAAQ,YAAY,WAAW;CAC3C,MAAM,KAAK,QAAQ,QAAQ,IAAI;CAC/B,MAAM,WAAW,QAAQ,QAAQ,UAAU;CAC3C,MAAM,eAAe,QAAQ,QAAQ,cAAc;CACnD,IAAI,OAAO,OAAO,YAAY,CAAC,OAAO,cAAc,QAAQ,KAAK,CAAC,MAAM,QAAQ,YAAY,GAAG;EAC7F,YAAY,IAAI,sBAAsB;EACtC,OAAO,QAAQ,WAAW;CAC5B;CACA,IAAI,aAAa,SAAS,OAAO,OAAO,iBACtC,YAAY,IAAI,0BAA0B;CAC5C,MAAM,sBAAsB,QAAQ,QAAQ,kBAAkB;CAC9D,MAAM,mBAAmB,wBAAwB,KAAA,IAAY,YAAY;CACzE,IAAI,OAAO,qBAAqB,UAAU,YAAY,IAAI,sBAAsB;MAC3E,iBAAiB,kBAAkB,QAAQ,WAAW;CAC3D,KAAK,MAAM,eAAe,cAAc;EACtC,IAAI,CAAC,YAAY,WAAW,GAAG;GAC7B,YAAY,IAAI,4BAA4B;GAC5C;EACF;EACA,YAAY,aAAa,kBAAkB,WAAW;EACtD,MAAM,OAAO,QAAQ,aAAa,MAAM;EACxC,IAAI,OAAO,SAAS,UAAU,YAAY,IAAI,4BAA4B;OACrE,IAAI,CAAC,OAAO,OAAO,aAAa,SAAS,IAAI,GAAG,YAAY,IAAI,uBAAuB;EAC5F,MAAM,YAAY,aAChB,QAAQ,aAAa,KAAK,GAC1B,OAAO,qBAAqB,WAAW,mBAAmB,WAC1D,WACF;EACA,IAAI,cAAc,KAAA,GAAW,iBAAiB,WAAW,QAAQ,WAAW;EAC5E,IACE,CAAC,OAAO,cAAc,QAAQ,aAAa,eAAe,CAAC,KAC3D,CAAC,QAAQ,aAAa,OAAO,GAE7B,YAAY,IAAI,4BAA4B;EAE9C,IAAI,OAAO,SAAS,YAAY,QAAQ,aAAa,OAAO,GAC1D,cAAc,QAAQ,aAAa,OAAO,GAAG,MAAM,QAAQ,WAAW;CAE1E;CACA,mBACE,QAAQ,QAAQ,YAAY,GAC5B,OAAO,qBAAqB,WAAW,mBAAmB,WAC1D,QACA,WACF;CACA,IAAI,YAAY,OAAO,SAAS,GAAG,OAAO,QAAQ,WAAW;CAC7D,OAAO;EACL,IAAI;EACJ,OAAO,kBAAkB,QAAiC,qBAAqB,OAAO,MAAM,CAAC;CAC/F;AACF;AAEA,SAAS,WAAW,OAAuB;CACzC,OAAO,IAAI,YAAY,CAAC,CAAC,OAAO,KAAK,CAAC,CAAC;AACzC;AAEA,SAAS,YAAY,QAAgB,QAAsB,QAAsC;CAC/F,IAAI,iBAAiB,MAAM,MAAM,KAAA,GAAW,OAAO,mBAAmB,MAAM,MAAM;CAClF,MAAM,cAAc,IAAI,YAAY,OAAO,OAAO,cAAc;CAChE,IAAI,WAAW,MAAM,IAAI,OAAO,OAAO,UAAU;EAC/C,YAAY,IAAI,mBAAmB;EACnC,OAAO,QAAQ,WAAW;CAC5B;CACA,IAAI;EACF,IAAI,WAAW,QAAQ,OAAO,mBAAmB,KAAK,MAAM,MAAM,GAAG,MAAM;EAC3E,MAAM,WAAW,cAAc,QAAQ;GAAE,cAAc;GAAO,QAAQ;GAAM,YAAY;EAAK,CAAC;EAC9F,IAAI,SAAS,OAAO,SAAS,GAAG;GAC9B,YAAY,IAAI,qBAAqB;GACrC,OAAO,QAAQ,WAAW;EAC5B;EACA,OAAO,mBAAmB,SAAS,KAAK,EAAE,eAAe,EAAE,CAAC,GAAG,MAAM;CACvE,QAAQ;EACN,YAAY,IAAI,WAAW,SAAS,wBAAwB,qBAAqB;EACjF,OAAO,QAAQ,WAAW;CAC5B;AACF;AAEA,SAAgB,eAAe,QAAgB,QAAmC;CAChF,OAAO,YAAY,QAAQ,QAAQ,MAAM;AAC3C;AAEA,SAAgB,eAAe,QAAgB,QAAmC;CAChF,OAAO,YAAY,QAAQ,QAAQ,MAAM;AAC3C;;;ACvmBA,MAAM,iBAAmC,OAAO,OAAO;CACrD,MAAM;CACN,SAAS;AACX,CAAC;AAED,SAAS,UAAU,aAAgE;CACjF,OAAO,OAAO,OAAO;EACnB,QAAQ;EACR,aAAa,OAAO,OAClB,YAAY,KAAK,UAAU,OAAO,OAAO;GAAE,MAAM,MAAM;GAAM,SAAS,MAAM;EAAQ,CAAC,CAAC,CACxF;CACF,CAAC;AACH;AAYA,SAAgB,0BACd,IACA,SACqB;CACrB,MAAM,SAAS,YAAY,QAAQ,MAAM;CACzC,MAAM,EAAE,SAAS;CACjB,MAAM,SAAwB,OAAO,OAAO;EAC1C;EACA,MAAM,KAAK,SAA4B;GACrC,MAAM,MAAM,MAAM,KAAK,OAAO;GAC9B,MAAM,SACJ,IAAI,WAAW,SACX,eAAe,IAAI,MAAM,MAAM,IAC/B,IAAI,WAAW,SACb,eAAe,IAAI,MAAM,MAAM,IAC/B,KAAA;GACR,IAAI,WAAW,KAAA,GAAW,OAAO,UAAU,CAAC,cAAc,CAAC;GAC3D,OAAO,OAAO,KAAK,OAAO,QAAQ,UAAU,OAAO,WAAW;EAChE;CACF,CAAC;CACD,OAAO,OAAO,OAAO;EAAE;EAAQ,OAAO,OAAO;CAAO,CAAC;AACvD"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@burojs/config",
-  "version": "0.4.0",
+  "version": "0.5.0",
   "license": "MIT",
   "description": "Buro: inert JSON and YAML declaration sources",
   "type": "module",
@@ -26,7 +26,7 @@
   ],
   "dependencies": {
     "yaml": "^2.8.2",
-    "@burojs/core": "0.4.0"
+    "@burojs/core": "0.5.0"
   },
   "devDependencies": {
     "typescript": "^5.5.0",