Configuration Migration Kit

Convert one bounded JSON, YAML, TOML, or env configuration with explicit type, omission, rename, and secret-handling evidence.

Developers migrating caller-owned configuration who need deterministic output and visible type-loss diagnostics instead of silent coercion.

Type and loss diagnostics

[
  {
    "code": "SECRET_REDACTED",
    "path": "password",
    "severity": "warning",
    "source_type": "string",
    "target_type": "string"
  }
]

Complete migration envelope

{
  "ok": true,
  "schema_version": "utilito.product-kit.v1",
  "kit": {
    "id": "configuration-migration-kit",
    "version": "1.0.0"
  },
  "result": {
    "converted_config": "{\n  \"enabled\": true,\n  \"name\": \"true\",\n  \"nested\": {\n    \"region\": \"us-east-1\"\n  },\n  \"optional\": null,\n  \"password\": \"[REDACTED]\",\n  \"retry_count\": 3\n}",
    "type_loss_diagnostics": [
      {
        "code": "SECRET_REDACTED",
        "path": "password",
        "severity": "warning",
        "source_type": "string",
        "target_type": "string"
      }
    ],
    "omitted_key_receipt": [],
    "sorted_key_manifest": [
      {
        "target_path": "enabled",
        "type": "boolean"
      },
      {
        "target_path": "name",
        "type": "string"
      },
      {
        "target_path": "nested",
        "type": "object"
      },
      {
        "target_path": "nested.region",
        "type": "string"
      },
      {
        "target_path": "optional",
        "type": "null"
      },
      {
        "target_path": "password",
        "type": "string"
      },
      {
        "target_path": "retry_count",
        "type": "number"
      }
    ],
    "migration_report": {
      "format": "markdown",
      "contains_secret_values": false,
      "content": "# Configuration migration report\n\n- Source format: yaml\n- Target format: json\n- Keys discovered: 6\n- Keys emitted: 6\n- Omitted keys: 0\n- Type/loss warnings: 1\n- Secret placeholders: 1\n\nValues were parsed and rendered deterministically. Secret values are never included in this report. Unsupported target semantics are listed as visible diagnostics. No file, network, model, storage, or telemetry operation occurred.\n"
    },
    "artifact_manifest": [
      {
        "name": "converted_config",
        "media_type": "application/json",
        "bytes": 152
      },
      {
        "name": "migration_report",
        "media_type": "text/markdown",
        "bytes": 416
      },
      {
        "name": "omitted_key_receipt",
        "media_type": "application/json",
        "bytes": 2
      },
      {
        "name": "sorted_key_manifest",
        "media_type": "application/json",
        "bytes": 429
      },
      {
        "name": "type_loss_diagnostics",
        "media_type": "application/json",
        "bytes": 150
      }
    ],
    "safety": {
      "browser_preview_download_only": true,
      "filesystem_used": false,
      "network_used": false,
      "model_used": false,
      "storage_used": false,
      "telemetry_used": false
    }
  },
  "receipt": {
    "input_bytes": 328,
    "source_bytes": 109,
    "output_bytes": 2383,
    "operations": 3,
    "omitted_items": 0,
    "warnings": [
      "SECRET_REDACTED"
    ],
    "source_format": "yaml",
    "target_format": "json",
    "keys_discovered": 6,
    "keys_emitted": 6,
    "secrets_redacted": 1,
    "artifacts": 5
  },
  "provenance": {
    "deterministic": true,
    "model_used": false,
    "network_used": false,
    "storage_used": false,
    "core_versions": {
      "configuration_migration_kit": "1.0.0",
      "config_format": "config-format-core",
      "file_integrity_manifest": "file-integrity-manifest-core"
    }
  },
  "error": null
}

Converted config Diagnostics Omitted keys Key manifest Report

Free runnable capability

Convert and download one bounded configuration migration packet locally with no signup.

Builder capability

The existing Builder Pilot can coordinate higher bounded review volume; it does not add filesystem access, deployment, secret retention, network calls, storage, or telemetry.

See the existing Builder Pilot

Privacy boundary

Browser generation runs locally. Secret-looking keys or values fail closed by default; explicit redaction can generate safe placeholders. API and MCP are response-only with no filesystem, network, model, storage, or telemetry use.

Limits and trust boundary

JSON objects, simple YAML mappings, common TOML tables and scalar arrays, and env key/value lines are supported. YAML sequences, anchors, tags, block scalars, TOML arrays of tables, inline tables, dates, multiline strings, and bare TOML strings fail visibly.
Duplicate keys and duplicate TOML table declarations fail closed. Quoted scalar strings stay strings; booleans, null, and finite numbers retain meaning where the target can represent them. TOML null values are omitted only with a visible diagnostic; env scalar types and unsupported nested arrays are stringified only with visible diagnostics.
Secret-looking keys or values never enter failure receipts or generated artifacts. browser_local and reject modes stop before materialization; explicit redact mode substitutes [REDACTED] and records only safe paths and counts.
Generation is preview/download only. It does not read or write files, fetch, call a model, store, send telemetry, publish, deploy, or mutate the submitted source. The complete success envelope is capped at 262,144 UTF-8 bytes.