runtime.schema.json

{
  "$defs": {
    "AuditConfig": {
      "additionalProperties": false,
      "description": "The audit journal: where it is written and the key its hashes use.",
      "else": {
        "required": [
          "path"
        ]
      },
      "if": {
        "properties": {
          "destination": {
            "const": "stdout"
          }
        },
        "required": [
          "destination"
        ]
      },
      "properties": {
        "destination": {
          "$ref": "#/$defs/AuditDestinationKind",
          "default": "file",
          "description": "Where audit entries go: a rotated `file` (the default) or `stdout`."
        },
        "hashKeyRef": {
          "$ref": "#/$defs/SecretReference",
          "description": "Secret reference to the audit hash key."
        },
        "path": {
          "description": "The active audit file. Required for, and only allowed with, `file`.",
          "pattern": "^/+(?:(?:[^/.][^/]*|\\.(?:[^/.][^/]*|\\.[^/]+)?)/+)*(?:[^/.][^/]*|\\.(?:[^/.][^/]*|\\.[^/]+))$",
          "type": "string"
        },
        "retentionDays": {
          "description": "Delete rotated files older than this many days. Only allowed with\n`file`; omitted, rotated files are kept 90 days.",
          "format": "uint32",
          "maximum": 36500,
          "minimum": 1,
          "type": "integer"
        },
        "rotateBytes": {
          "description": "Rotate the active file once it reaches this many bytes. Only allowed\nwith `file`; omitted, the file rotates at 100 MiB.",
          "format": "uint64",
          "maximum": 4294967295,
          "minimum": 1048576,
          "type": "integer"
        }
      },
      "required": [
        "hashKeyRef"
      ],
      "then": {
        "not": {
          "anyOf": [
            {
              "required": [
                "path"
              ]
            },
            {
              "required": [
                "rotateBytes"
              ]
            },
            {
              "required": [
                "retentionDays"
              ]
            }
          ]
        }
      },
      "type": "object"
    },
    "AuditDestinationKind": {
      "description": "The configured audit destination kind, as written in product configuration.",
      "oneOf": [
        {
          "const": "file",
          "description": "Durable, rotated JSON Lines file.",
          "type": "string"
        },
        {
          "const": "stdout",
          "description": "One JSON line per entry on standard output, flushed per entry.",
          "type": "string"
        }
      ]
    },
    "AuthenticationConfig": {
      "additionalProperties": false,
      "properties": {
        "oidc": {
          "$ref": "#/$defs/OidcConfig"
        }
      },
      "required": [
        "oidc"
      ],
      "type": "object"
    },
    "BusyImpactProjection": {
      "enum": [
        "count-only",
        "commitment-intervals"
      ],
      "type": "string"
    },
    "BusyImportProfileConfig": {
      "additionalProperties": false,
      "description": "One operator-authorized source and its current resource ceiling.",
      "properties": {
        "impactProjection": {
          "$ref": "#/$defs/BusyImpactProjection",
          "default": "count-only"
        },
        "maximumFreshnessMinutes": {
          "format": "uint32",
          "maximum": 10080,
          "minimum": 1,
          "type": "integer"
        },
        "maximumFutureDays": {
          "format": "uint32",
          "maximum": 3650,
          "minimum": 0,
          "type": "integer"
        },
        "maximumPastDays": {
          "format": "uint32",
          "maximum": 3650,
          "minimum": 0,
          "type": "integer"
        },
        "maximumSpanDays": {
          "format": "uint32",
          "maximum": 62,
          "minimum": 1,
          "type": "integer"
        },
        "resources": {
          "items": {
            "$ref": "#/$defs/LocalId"
          },
          "type": "array",
          "uniqueItems": true
        },
        "scope": {
          "type": "string"
        },
        "sourceId": {
          "type": "string"
        }
      },
      "required": [
        "scope",
        "sourceId",
        "resources",
        "maximumPastDays",
        "maximumFutureDays",
        "maximumSpanDays",
        "maximumFreshnessMinutes"
      ],
      "type": "object"
    },
    "DatabaseConfig": {
      "additionalProperties": false,
      "description": "The PostgreSQL connection a stateful runtime uses. Both URLs are secret\nreferences and may name the same secret.",
      "properties": {
        "migrationUrlRef": {
          "$ref": "#/$defs/SecretReference",
          "description": "Secret reference to the migration connection URL."
        },
        "runtimeUrlRef": {
          "$ref": "#/$defs/SecretReference",
          "description": "Secret reference to the least-privileged runtime connection URL."
        },
        "testOnlyPlaintext": {
          "default": false,
          "description": "Allow a plaintext connection. Refused outside test builds.",
          "type": "boolean"
        },
        "trustedRootCertificateRef": {
          "$ref": "#/$defs/SecretReference",
          "description": "Secret reference to a PEM root certificate the connection trusts.\nAbsent, the connection trusts the platform's root certificates."
        }
      },
      "required": [
        "runtimeUrlRef",
        "migrationUrlRef"
      ],
      "type": "object"
    },
    "DestinationsConfig": {
      "additionalProperties": false,
      "description": "Where due reminder and lifecycle-hook intents are dispatched. An absent\nreminders destination and an empty hook map are supported: intents stay\nlocal, so an operator can adopt the product before wiring delivery buses.",
      "properties": {
        "hooks": {
          "additionalProperties": {
            "$ref": "#/$defs/UrlHookDestinationConfig"
          },
          "default": {},
          "description": "Logical URL hook destinations. The governed policy names only these\nids; URL, signing secret, and retry ceilings stay deployment-owned.\nAt most 128 are bound, each keyed by a local identifier.",
          "maxProperties": 128,
          "propertyNames": {
            "$ref": "#/$defs/LocalId"
          },
          "type": "object"
        },
        "reminders": {
          "$ref": "#/$defs/ReminderDestinationConfig"
        }
      },
      "type": "object"
    },
    "Digest": {
      "description": "A SHA-256 digest: `sha256:` followed by 64 lowercase hex digits.",
      "pattern": "^sha256:[0-9a-f]{64}$",
      "type": "string"
    },
    "EnvironmentSecretProviderConfig": {
      "additionalProperties": false,
      "description": "The environment secret provider. It takes no settings.",
      "type": "object"
    },
    "ExternalId": {
      "description": "An identifier another system issues, written exactly as its issuer gives it.",
      "maxLength": 512,
      "minLength": 1,
      "pattern": "^[^\\u0000-\\u001F\\u007F-\\u009F]+$",
      "type": "string"
    },
    "FileSecretProviderConfig": {
      "additionalProperties": false,
      "description": "The file secret provider.",
      "properties": {
        "root": {
          "description": "Absolute directory holding one file per secret. Each file must be a\nregular file owned by the runtime user, mode 0400 or 0600, with exactly\none hard link.",
          "pattern": "^/",
          "type": "string"
        }
      },
      "required": [
        "root"
      ],
      "type": "object"
    },
    "JwksSource": {
      "description": "Where a runtime obtains the OIDC issuer's signing keys.",
      "oneOf": [
        {
          "additionalProperties": false,
          "description": "Read `jwks_uri` from the issuer's OpenID Connect discovery document.",
          "properties": {
            "type": {
              "const": "discovery",
              "type": "string"
            }
          },
          "required": [
            "type"
          ],
          "type": "object"
        },
        {
          "additionalProperties": false,
          "description": "Fetch the key set from this absolute `https` URI, skipping discovery.\nA plain `http` URI is accepted on loopback for supervised local\ndevelopment, and beyond loopback only when the issuer block sets\n`allowInsecureHttp`.",
          "properties": {
            "type": {
              "const": "uri",
              "type": "string"
            },
            "uri": {
              "$ref": "#/$defs/Url"
            }
          },
          "required": [
            "type",
            "uri"
          ],
          "type": "object"
        },
        {
          "additionalProperties": false,
          "description": "Read the key set from a secret, for deployments without network access\nto the issuer.",
          "properties": {
            "documentRef": {
              "$ref": "#/$defs/SecretReference"
            },
            "type": {
              "const": "static",
              "type": "string"
            }
          },
          "required": [
            "type",
            "documentRef"
          ],
          "type": "object"
        }
      ]
    },
    "ListenerBind": {
      "description": "Socket address the runtime listens on, written host:port with an IP address host ([addr]:port for IPv6).",
      "maxLength": 128,
      "minLength": 1,
      "type": "string"
    },
    "ListenerNetworkExposure": {
      "description": "The operator-declared private network placement of an HTTP listener.",
      "enum": [
        "private-address",
        "container-private"
      ],
      "type": "string"
    },
    "LocalId": {
      "description": "A local identifier: a lowercase letter, then up to 63 lowercase letters, digits, `_`, or `-`.",
      "pattern": "^[a-z][a-z0-9_-]{0,63}$",
      "type": "string"
    },
    "OidcConfig": {
      "additionalProperties": false,
      "description": "The access tokens this runtime accepts: the issuer and its keys, the\nclients admitted, and the scopes each route family requires.",
      "properties": {
        "allowInsecureHttp": {
          "default": false,
          "description": "Permit plain HTTP beyond loopback to the configured issuer and to a\nJWKS URI declared in configuration. TLS remains required unless the\noperator explicitly accepts this transport risk.",
          "type": "boolean"
        },
        "allowedClients": {
          "description": "Client identifiers whose access tokens are admitted. Required in every\nfile; an omitted or empty list, a repeated client, and `unrestricted`\nare refused.",
          "items": {
            "type": "string"
          },
          "minItems": 1,
          "type": "array",
          "uniqueItems": true
        },
        "appointmentReadProfiles": {
          "additionalProperties": {
            "$ref": "#/$defs/OperationalReadProfileConfig"
          },
          "description": "Opt-in cross-owner operational appointment read roles. An omitted or\nempty map grants no operational appointment authority.",
          "propertyNames": {
            "$ref": "#/$defs/LocalId"
          },
          "type": "object"
        },
        "assertionIssuers": {
          "additionalProperties": {
            "items": {
              "maxLength": 512,
              "minLength": 1,
              "type": "string"
            },
            "maxItems": 16,
            "minItems": 1,
            "type": "array",
            "uniqueItems": true
          },
          "description": "Assertion authorities each client may exchange a subject token from,\nkeyed by client identifier. Omitted, no assertion-issuer rule applies;\nwritten, it lists at least one client, each with at least one\nauthority. Once a client is listed, a token it exchanged is accepted\nonly for one of that client's declared authorities, and a client that\nis not listed may exchange from no authority.",
          "maxProperties": 64,
          "minProperties": 1,
          "propertyNames": {
            "$ref": "#/$defs/ExternalId",
            "maxLength": 128
          },
          "type": "object"
        },
        "audience": {
          "description": "The audience every accepted access token must carry in `aud`.",
          "maxLength": 512,
          "minLength": 1,
          "type": "string"
        },
        "busyImportProfiles": {
          "additionalProperties": {
            "$ref": "#/$defs/BusyImportProfileConfig"
          },
          "description": "Opt-in source-owned busy import roles. Each selected profile binds one\nstable source id and an explicit resource ceiling.",
          "propertyNames": {
            "$ref": "#/$defs/LocalId"
          },
          "type": "object"
        },
        "explainScope": {
          "default": "scheduling:explain",
          "description": "The scope the separately authorized explain path requires.",
          "type": "string"
        },
        "issuer": {
          "$ref": "#/$defs/Url",
          "description": "Exact issuer accepted in access-token `iss` claims, an absolute\n`https` URL, or a plain `http` URL when `allowInsecureHttp` is set."
        },
        "jwksSource": {
          "$ref": "#/$defs/JwksSource",
          "default": {
            "type": "discovery"
          },
          "description": "Where the issuer's signing keys come from. Absent reads the issuer's\nOpenID Connect discovery document."
        },
        "readsScope": {
          "default": "scheduling:read",
          "description": "The scope every listing and availability read requires.",
          "type": "string"
        },
        "scopeClaim": {
          "default": "scope",
          "description": "The claim carrying the accepted OAuth scopes.",
          "type": "string"
        }
      },
      "required": [
        "issuer",
        "audience",
        "allowedClients"
      ],
      "type": "object"
    },
    "OperationalProjectionConfig": {
      "additionalProperties": false,
      "description": "The explicit projection allowed for one role.",
      "properties": {
        "externalReferenceProducts": {
          "description": "Source products whose exact references may be filtered and returned.",
          "items": {
            "$ref": "#/$defs/LocalId"
          },
          "type": "array",
          "uniqueItems": true
        },
        "fields": {
          "items": {
            "$ref": "#/$defs/OperationalProjectionField"
          },
          "type": "array",
          "uniqueItems": true
        }
      },
      "required": [
        "fields"
      ],
      "type": "object"
    },
    "OperationalProjectionField": {
      "description": "Fields an operational response may contain. Identity, contact, manager,\nParty references and actor fields are deliberately absent from this vocabulary.",
      "enum": [
        "occupied-interval",
        "resource",
        "units",
        "party-counts",
        "allocations",
        "attendance"
      ],
      "type": "string"
    },
    "OperationalReadPermissionConfig": {
      "additionalProperties": false,
      "description": "One exact service/location authority within a profile.",
      "properties": {
        "location": {
          "type": "string"
        },
        "resources": {
          "$ref": "#/$defs/OperationalResourceScope"
        },
        "service": {
          "type": "string"
        }
      },
      "required": [
        "service",
        "location",
        "resources"
      ],
      "type": "object"
    },
    "OperationalReadProfileConfig": {
      "additionalProperties": false,
      "description": "One opt-in operational role. No profile is synthesized when the map is\nabsent: an empty map grants no appointment read authority.",
      "properties": {
        "maximumFutureDays": {
          "description": "How far ahead of the observed instant a query may end.",
          "format": "uint32",
          "maximum": 3650,
          "minimum": 0,
          "type": "integer"
        },
        "maximumPastDays": {
          "description": "How far behind the observed instant a query may begin.",
          "format": "uint32",
          "maximum": 3650,
          "minimum": 0,
          "type": "integer"
        },
        "maximumSpanDays": {
          "description": "The maximum duration of one request's half-open interval.",
          "format": "uint32",
          "maximum": 62,
          "minimum": 1,
          "type": "integer"
        },
        "permissions": {
          "items": {
            "$ref": "#/$defs/OperationalReadPermissionConfig"
          },
          "type": "array"
        },
        "projection": {
          "$ref": "#/$defs/OperationalProjectionConfig"
        },
        "scope": {
          "description": "The OAuth scope that selects this role after token verification.",
          "type": "string"
        }
      },
      "required": [
        "scope",
        "maximumPastDays",
        "maximumFutureDays",
        "maximumSpanDays",
        "permissions",
        "projection"
      ],
      "type": "object"
    },
    "OperationalResourceScope": {
      "description": "The resource authority at one service/location pair. `Unrestricted` is an\nexplicit operator statement, never an omitted default.",
      "oneOf": [
        {
          "additionalProperties": false,
          "properties": {
            "type": {
              "const": "unrestricted",
              "type": "string"
            }
          },
          "required": [
            "type"
          ],
          "type": "object"
        },
        {
          "additionalProperties": false,
          "properties": {
            "ids": {
              "items": {
                "$ref": "#/$defs/LocalId"
              },
              "type": "array",
              "uniqueItems": true
            },
            "type": {
              "const": "exact",
              "type": "string"
            }
          },
          "required": [
            "type",
            "ids"
          ],
          "type": "object"
        }
      ]
    },
    "PackageConfig": {
      "additionalProperties": false,
      "description": "The package a runtime serves: `root` is the absolute package directory,\nand `expectedDigest`, when set, pins the package digest the runtime must\nfind there. The package digest is the digest of the package's\n`SHA256SUMS` file; see [`crate::package`].",
      "properties": {
        "expectedDigest": {
          "$ref": "#/$defs/Digest",
          "description": "`sha256:` label of the package digest, the digest of the package's\n`SHA256SUMS` file. When set, the runtime refuses to start on any other\npackage."
        },
        "root": {
          "description": "Absolute path of the package directory.",
          "pattern": "^/",
          "type": "string"
        }
      },
      "required": [
        "root"
      ],
      "type": "object"
    },
    "PrivateListenerConfig": {
      "additionalProperties": false,
      "description": "The listener of a runtime that declares its TLS termination and network\nexposure.",
      "properties": {
        "bind": {
          "$ref": "#/$defs/ListenerBind"
        },
        "networkExposure": {
          "$ref": "#/$defs/ListenerNetworkExposure",
          "default": "private-address"
        },
        "tlsTermination": {
          "$ref": "#/$defs/TlsTermination"
        }
      },
      "required": [
        "bind",
        "tlsTermination"
      ],
      "type": "object"
    },
    "ReminderDestinationConfig": {
      "additionalProperties": false,
      "properties": {
        "bearerTokenRef": {
          "$ref": "#/$defs/SecretReference"
        },
        "hmacSha256KeyRef": {
          "$ref": "#/$defs/SecretReference",
          "description": "Optional HMAC-SHA-256 key for the shared signed event-delivery\ncontract. Bearer authentication, when configured, remains independent."
        },
        "purposeUrls": {
          "$ref": "#/$defs/ReminderPurposeUrls",
          "description": "Optional endpoints for individual reminder purposes. Any omitted\npurpose uses `url`; every override must share that URL's origin."
        },
        "url": {
          "$ref": "#/$defs/Url",
          "description": "An https URL, or http on 127.0.0.1, localhost, or [::1], without a\nquery or fragment."
        }
      },
      "required": [
        "url"
      ],
      "type": "object"
    },
    "ReminderPurposeUrls": {
      "additionalProperties": false,
      "description": "Optional endpoint overrides named for the four reminder intent purposes\nScheduling emits.",
      "properties": {
        "cancellation": {
          "$ref": "#/$defs/Url"
        },
        "change": {
          "$ref": "#/$defs/Url"
        },
        "confirmation": {
          "$ref": "#/$defs/Url"
        },
        "reminder": {
          "$ref": "#/$defs/Url"
        }
      },
      "type": "object"
    },
    "RetentionConfig": {
      "additionalProperties": false,
      "description": "Retention periods the retention sweep enforces. Every value is deployment\nconfiguration, never policy: a jurisdiction's retention schedule approves\nthe deployed numbers, and changing one is an operational event.",
      "properties": {
        "claimOwnerRetentionDays": {
          "default": 7,
          "description": "How long raw ownership remains after an appointment ends or is\ncancelled, or a hold expires, is released, or is consumed.",
          "format": "uint32",
          "maximum": 365,
          "minimum": 1,
          "type": "integer"
        },
        "hookPayloadRetentionDays": {
          "default": 7,
          "description": "Lifetime of canonical hook envelopes retained for retry and\ndead-letter inspection, from one through thirty days.",
          "format": "uint32",
          "maximum": 30,
          "minimum": 1,
          "type": "integer"
        },
        "receiptRetentionDays": {
          "default": 7,
          "description": "How long a stored idempotency receipt stays replayable, from one\nthrough 365 days.",
          "format": "uint32",
          "maximum": 365,
          "minimum": 1,
          "type": "integer"
        }
      },
      "type": "object"
    },
    "SecretProvidersConfig": {
      "additionalProperties": false,
      "anyOf": [
        {
          "properties": {
            "file": {
              "$ref": "#/$defs/FileSecretProviderConfig"
            }
          },
          "required": [
            "file"
          ]
        },
        {
          "properties": {
            "environment": {
              "$ref": "#/$defs/EnvironmentSecretProviderConfig"
            }
          },
          "required": [
            "environment"
          ]
        }
      ],
      "description": "The secret providers a runtime enables. A reference is resolved only by a\nprovider declared here: `secret:file/name` under `file.root`, and\n`secret:env/NAME` only when `environment: {}` is present.",
      "properties": {
        "environment": {
          "$ref": "#/$defs/EnvironmentSecretProviderConfig",
          "description": "Enables `secret:env/NAME` references, read from the process\nenvironment. Declared as an empty mapping: `environment: {}`."
        },
        "file": {
          "$ref": "#/$defs/FileSecretProviderConfig",
          "description": "Enables `secret:file/name` references, read from files under `root`."
        }
      },
      "type": "object"
    },
    "SecretReference": {
      "description": "An exact secret reference: secret:file/name, resolved under secretProviders.file.root, or secret:env/NAME, resolved only when secretProviders.environment is declared.",
      "pattern": "^(?:secret:env/[A-Z][A-Z0-9_]{0,127}|secret:file/[a-z][a-z0-9._-]{0,127})$",
      "type": "string"
    },
    "TaskGrantStatusConfig": {
      "additionalProperties": false,
      "description": "One task authority whose grants a runtime checks for fresh status, and the\nruntime's own credentials for that check, written as one entry of\n`taskGrantStatus`. The status route and scope default to Casework's.",
      "properties": {
        "baseUrl": {
          "$ref": "#/$defs/Url",
          "description": "The authority's base URL the status check calls. It is `https`;\n`http` is accepted only for a loopback host, for local development."
        },
        "caBundleRef": {
          "$ref": "#/$defs/SecretReference",
          "description": "PEM CA bundle for the authority and its token endpoint. Omitted, the\nplatform's trusted roots verify them."
        },
        "clientAssertionAudience": {
          "$ref": "#/$defs/ExternalId"
        },
        "clientId": {
          "$ref": "#/$defs/ExternalId"
        },
        "privateKeyRef": {
          "$ref": "#/$defs/SecretReference"
        },
        "sourceIssuer": {
          "$ref": "#/$defs/ExternalId",
          "description": "The task authority's issuer, exactly as the authority states it,\nincluding an absolute URN issuer. It is compared rather than fetched\nand must be an absolute resource URI."
        },
        "statusPath": {
          "default": "/v1/task-grants/{grantId}/status",
          "description": "The status route appended to `baseUrl`'s path. It starts with `/` and\nhas exactly one whole `{grantId}` segment; every other segment uses\nonly letters, digits, `-`, `.`, `_`, and `~`. Omitted,\n`/v1/task-grants/{grantId}/status`.",
          "type": "string"
        },
        "statusResource": {
          "$ref": "#/$defs/ExternalId",
          "description": "The audience the runtime requests its status credential for, an\nabsolute resource URI."
        },
        "statusScope": {
          "$ref": "#/$defs/ExternalId",
          "default": "casework:grants:status",
          "description": "The one scope the runtime requests its status credential with.\nOmitted, `casework:grants:status`."
        },
        "tokenEndpoint": {
          "$ref": "#/$defs/Url"
        }
      },
      "required": [
        "sourceIssuer",
        "baseUrl",
        "tokenEndpoint",
        "clientAssertionAudience",
        "clientId",
        "privateKeyRef",
        "statusResource"
      ],
      "type": "object"
    },
    "TlsTermination": {
      "description": "Declares the trusted transport boundary for a runtime's plaintext HTTP\nlistener. Production listeners require operator-controlled upstream TLS\ntermination; direct plaintext is limited to the explicit loopback-only\ndevelopment mode.",
      "enum": [
        "operator-controlled-upstream",
        "development-loopback"
      ],
      "type": "string"
    },
    "Url": {
      "description": "An absolute http or https URL with a host preserved as written, no user information, and no backslash, whitespace or control character. DNS case and equivalent IPv6 literals are permitted.",
      "format": "uri",
      "maxLength": 2048,
      "pattern": "^[Hh][Tt][Tt][Pp][Ss]?://[^/?#@\\u005C\\u0000-\\u0020\\u007F-\\u00A0\\u1680\\u2000-\\u200A\\u2028\\u2029\\u202F\\u205F\\u3000]+([/?#][^\\u005C\\u0000-\\u0020\\u007F-\\u00A0\\u1680\\u2000-\\u200A\\u2028\\u2029\\u202F\\u205F\\u3000]*)?$",
      "type": "string"
    },
    "UrlHookDestinationConfig": {
      "additionalProperties": false,
      "description": "One URL hook destination a runtime signs and sends hook deliveries to:\nthe URL, the HMAC-SHA256 key reference, and the delivery budget. The\noutbound policy is fixed: `registry-platform-hooks` activates it with no\nprivate address range and no client certificate. A runtime whose\ndestinations need either configures its own full outbound policy instead.",
      "properties": {
        "attemptTimeoutMilliseconds": {
          "default": 5000,
          "description": "How long one delivery attempt may take, from 100 through 10000\nmilliseconds.",
          "format": "uint32",
          "maximum": 10000,
          "minimum": 100,
          "type": "integer"
        },
        "hmacSha256KeyRef": {
          "$ref": "#/$defs/SecretReference"
        },
        "maximumAttempts": {
          "default": 8,
          "description": "How many delivery attempts one event gets, from 1 through 20.",
          "format": "uint8",
          "maximum": 20,
          "minimum": 1,
          "type": "integer"
        },
        "url": {
          "$ref": "#/$defs/Url",
          "description": "An https URL, or http on 127.0.0.1, localhost, or [::1], without a\nquery or fragment."
        }
      },
      "required": [
        "url",
        "hmacSha256KeyRef"
      ],
      "type": "object"
    }
  },
  "$id": "https://id.registrystack.org/schemas/scheduling/runtime/runtime.v1alpha1.schema.json",
  "$schema": "https://json-schema.org/draft/2020-12/schema",
  "additionalProperties": false,
  "allOf": [
    {
      "if": {
        "properties": {
          "authentication": {
            "properties": {
              "oidc": {
                "properties": {
                  "jwksSource": {
                    "properties": {
                      "documentRef": {
                        "pattern": "^secret:env/"
                      }
                    },
                    "required": [
                      "documentRef"
                    ]
                  }
                },
                "required": [
                  "jwksSource"
                ]
              }
            },
            "required": [
              "oidc"
            ]
          }
        },
        "required": [
          "authentication"
        ]
      },
      "then": {
        "properties": {
          "secretProviders": {
            "properties": {
              "environment": {
                "$ref": "#/$defs/EnvironmentSecretProviderConfig"
              }
            },
            "required": [
              "environment"
            ]
          }
        }
      }
    },
    {
      "if": {
        "properties": {
          "authentication": {
            "properties": {
              "oidc": {
                "properties": {
                  "jwksSource": {
                    "properties": {
                      "documentRef": {
                        "pattern": "^secret:file/"
                      }
                    },
                    "required": [
                      "documentRef"
                    ]
                  }
                },
                "required": [
                  "jwksSource"
                ]
              }
            },
            "required": [
              "oidc"
            ]
          }
        },
        "required": [
          "authentication"
        ]
      },
      "then": {
        "properties": {
          "secretProviders": {
            "properties": {
              "file": {
                "$ref": "#/$defs/FileSecretProviderConfig"
              }
            },
            "required": [
              "file"
            ]
          }
        }
      }
    }
  ],
  "description": "The operator runtime configuration document.",
  "properties": {
    "apiVersion": {
      "const": "id.registrystack.org/formats/scheduling/runtime/v1alpha1",
      "type": "string"
    },
    "audit": {
      "$ref": "#/$defs/AuditConfig"
    },
    "authentication": {
      "$ref": "#/$defs/AuthenticationConfig"
    },
    "database": {
      "$ref": "#/$defs/DatabaseConfig"
    },
    "destinations": {
      "$ref": "#/$defs/DestinationsConfig"
    },
    "identity": {
      "additionalProperties": false,
      "description": "The logical identity of the database this deployment owns. The first\n`schedulingctl apply` records it; every later apply and every startup\nrefuses a database that recorded another.",
      "properties": {
        "databaseId": {
          "description": "An operator-chosen logical id for the database, for example\n`scheduling-production`. It is never derived from a URL or a\nPostgreSQL database name. It is at most 256 UTF-8 bytes, carries no\ncontrol character, and has no leading or trailing whitespace.",
          "maxLength": 256,
          "minLength": 1,
          "pattern": "^[^\\u0000-\\u001f\\u007f-\\u009f \\u00a0\\u1680\\u2000-\\u200a\\u2028\\u2029\\u202f\\u205f\\u3000](?:[^\\u0000-\\u001f\\u007f-\\u009f]*[^\\u0000-\\u001f\\u007f-\\u009f \\u00a0\\u1680\\u2000-\\u200a\\u2028\\u2029\\u202f\\u205f\\u3000])?$",
          "type": "string"
        }
      },
      "required": [
        "databaseId"
      ],
      "type": "object"
    },
    "kind": {
      "const": "SchedulingRuntimeConfig",
      "type": "string"
    },
    "listener": {
      "$ref": "#/$defs/PrivateListenerConfig"
    },
    "package": {
      "$ref": "#/$defs/PackageConfig"
    },
    "retention": {
      "$ref": "#/$defs/RetentionConfig"
    },
    "secretProviders": {
      "$ref": "#/$defs/SecretProvidersConfig"
    },
    "taskGrantStatus": {
      "anyOf": [
        {
          "const": "unchecked-final-fifteen-minutes",
          "description": "Accept only a grant with at most fifteen minutes left at request\nentry, with no revocation check.",
          "type": "string"
        },
        {
          "description": "Check fresh grant status with these task authorities for every\ncommitment and replay.",
          "items": {
            "$ref": "#/$defs/TaskGrantStatusConfig"
          },
          "minItems": 1,
          "type": "array"
        }
      ],
      "description": "How a task grant is checked before capacity work: a list of the task\nauthorities whose fresh grant status every commitment and replay\nchecks, or `unchecked-final-fifteen-minutes` to accept only a grant\nwith at most fifteen minutes left, without a revocation check."
    }
  },
  "required": [
    "apiVersion",
    "kind",
    "identity",
    "package",
    "listener",
    "secretProviders",
    "database",
    "authentication",
    "taskGrantStatus",
    "audit",
    "retention"
  ],
  "title": "Registry Scheduling runtime configuration",
  "type": "object"
}