@burojs/config

Inert JSON and YAML declaration sources for buro.

Parses a raw JSON or YAML string against a host-owned SourcePolicy and produces a portable declaration layer — or a list of diagnostics if the source is malformed, oversized, or requests something its policy doesn't allow. The output can only ever be data: no functions, components, schemas, credentials, or provider/action/mapper bindings survive the parse.

Install

pnpm add @burojs/config

Usage

import { parseJsonLayer, type SourcePolicy } from '@burojs/config';

const policy: SourcePolicy = {
  allowedKinds: ['resource'],
  allowedNamespaces: ['crm'],
  allowedTransformOps: [],
  maxTransformScope: 'layer',
  allowedCapabilities: {},
  limits: { maxBytes: 16_000, maxDeclarations: 12, maxDepth: 16, maxStringLength: 1_000, maxDiagnostics: 8 },
};

const source = JSON.stringify({
  id: 'static-catalog',
  priority: 0,
  defaultNamespace: 'crm',
  revision: 'r1',
  declarations: [
    { kind: 'resource', ref: 'company', schemaVersion: 1, value: { name: 'company' } },
  ],
});

const result = parseJsonLayer(source, policy);
if (!result.ok) throw new Error(result.diagnostics.map((d) => d.code).join(', '));
// result.value is a LayerInput, ready for runtime.publishLayer(...)

To load a source lazily instead of publishing it up front, wrap the parser in createConfigRuntimeSource and hand the result to a core LayerRuntime via registerSource/loadSource.

Main exports

• parseJsonLayer / parseYamlLayer — parse a source string against a SourcePolicy, returning a ParseResult.
• createConfigRuntimeSource — builds a core RuntimeSource that fetches, parses, and adapts a source on demand.
• adaptRawConfig / parseResultAdapter — the pure adapter boundary between a raw source shape and the layer the runtime commits.
• SourcePolicy / SourceLimits — the allow-list and resource limits a host defines for one untrusted source.

See docs/raw-config-manifests.md for the full source-policy boundary and how it composes with a LayerRuntime.

License

MIT