Each `cordis.yml` entry can carry a `config` block, and the plugin declares a schema that validates it before `apply` runs. Bad config fails the load with a precise error — the plugin never starts half-configured.
## A configurable plugin
Create `config-demo.ts` in `tmp/cordis-tutorial`:
```ts
importtype{Context}from'cordis'
importSchemafrom'schemastery'
exportconstname='config-demo'
exportinterfaceConfig{
greeting: string
targets: string[]
}
exportconstConfig: Schema<Config>=Schema.object({
greeting: Schema.string().default('Hello'),
targets: Schema.array(String).default(['world']),
})
exportfunctionapply(ctx: Context,config: Config){
for(consttargetofconfig.targets){
console.log(`${config.greeting}, ${target}!`)
}
}
```
The exported `Config` is both a TypeScript interface and a runtime schema with the same name — consumers get the type, Cordis gets the validator. This repo uses [Schemastery](https://github.com/shigma/schemastery) for schemas; Cordis itself accepts any [Standard Schema](https://standardschema.dev/) validator, so a plain object exported as `Config` will not work.
Configure it:
```yaml
- name:'./config-demo.ts'
config:
targets:['alpha','beta']
```
Run:
```
Hello, alpha!
Hello, beta!
```
`greeting` was omitted, so the schema default filled it in — `apply` always receives complete, validated config.
## Fail loud
Now feed it something invalid:
```yaml
- name:'./config-demo.ts'
config:
targets:'not-an-array'
```
```
ValidationError: invalid config:
- $.targets expected array but got not-an-array (at targets)
```
The plugin's fiber goes to FAILED, and this tutorial's launcher exits with status 1 after printing the error. A plugin should also reject schema-valid config that names an unavailable resource or provider as soon as it can resolve that reference.
## Computed config values
The loader used in this repo supports a `!!js` tag for config values that must be computed at load time, such as reading an API key from the environment:
```yaml
- name:'@deepseek-ai/dsh-llm-deepseek'
config:
apiKey:!!jsprocess.env.DEEPSEEK_API_KEY
```
`!!js` works **only inside `config`**. Entry metadata (`name`, `id`, `disabled`, `inject`, ...) is static; `disabled: !!js ...` produces a truthy expression object that always disables the entry. See [loader configuration](../cordis-primer.md#loader-configuration).
Next: [Composition and HMR](06-composition-and-hmr.md) — treating `cordis.yml` as the application.