@limaformat/lima npm
TypeScript/JavaScript implementation. Published, zero dependencies.
Frozen at 1.0 · Zero dependencies
LIMA Is Metadata Annotation.
A small, specified frontmatter format. Familiar YAML-style syntax, common metadata types, and optional references — while intentionally leaving out much of YAML's broader grammar. A TypeScript implementation and a language-neutral conformance corpus are available today.
$ npm install @limaformat/lima
Why not YAML, TOML, or JSON?
Fifteen lines of frontmatter don't need a specification five times longer than JSON's or TOML's.
- YAML — a large, feature-rich grammar. Frontmatter typically uses a small fraction of it, and the unused parts are exactly where implementations diverge from each other and where past CVEs have concentrated.
- TOML — solid, but its
[section]/key = valuesyntax is noticeably more verbose than indentation for nested frontmatter, and it has no equivalent of Lima's References. - JSON — no comments, every key and string must be quoted, no multi-line strings — workable for machines, awkward to hand-author and diff as frontmatter.
Numbers instead of adjectives
Both sides hand-authored TypeScript source, never a bundled/minified build. Lima Core is
js/src/; the YAML column is js-yaml 5.2.3's actual parse path.
| JSON
(RFC 8259) |
TOML | Lima Core | Lima Core
+ References |
YAML 1.2.2 | |
|---|---|---|---|---|---|
| Specification (words) | 3,998 | 4,254 | 7,603 | 11,733 | 21,961 |
| Implementation, code (words) | — | — | 5,292 | 7,440 | 11,787 |
| Implementation, comments (words) | — | — | 2,398 | 4,472 | 2,144 |
| Package size (npm, packed) | — | — | — | 41 KB | 330 KB |
YAML's specification is ~5.2–5.5× longer than JSON's or TOML's, and ~2.9× longer than Lima Core's. Lima Core's code is ~2.2× smaller than js-yaml's parse path. The full accounting, including what counts as "Core" vs. "References" and why, is in the guide.
Package size is the real npm registry tarball (Core and References always ship together, so there's no separate "Core alone" number). Part of the gap is scope, not just code: js-yaml also ships full YAML 1.2 support and pre-built browser bundles that Lima doesn't need.
Two fewer attack surfaces
Not "Lima is unhackable" — narrower and more honest than that: two specific, named attack classes have no construct to exploit, by construction.
- CVE-2020-1747 (PyYAML, CVSS 9.8 critical) — arbitrary code execution via the
!!python/object/newtag construct. Lima has no tag system at all. - CVE-2019-11253 (Kubernetes API server, "Billion Laughs") — denial of service via anchor/alias exponential expansion. Lima has no anchors or aliases.
One implementation, one shared corpus
TypeScript is checked against a 250-case conformance corpus designed so a future Rust implementation can be checked against the exact same cases — see Packages and Conformance.
lima crates.io — placeholder
Rust implementation. Name reserved on crates.io; not yet started.