{
  "$schema": "https://json-schema.org/draft-07/schema#",
  "$id": "https://schema.golem.cloud/app/golem/1.6.0/golem.schema.json",
  "title": "Golem Application Manifest",
  "description": "Golem Application Manifest.",
  "type": "object",
  "additionalProperties": false,
  "properties": {
    "manifestVersion": {
      "type": "string",
      "description": "Application manifest document version"
    },
    "app": {
      "type": "string",
      "description": "Application name"
    },
    "includes": {
      "type": "array",
      "description": "Include paths or globs for searching for application manifest documents. Only allowed in root application manifest documents.",
      "items": {
        "type": "string"
      }
    },
    "componentTemplates": {
      "type": "object",
      "description": "Component templates by template names",
      "additionalProperties": {
        "$ref": "#/definitions/componentTemplate"
      }
    },
    "components": {
      "type": "object",
      "description": "Components by component names",
      "additionalProperties": {
        "$ref": "#/definitions/component"
      }
    },
    "agents": {
      "type": "object",
      "description": "Agents by agent type names",
      "additionalProperties": {
        "$ref": "#/definitions/agent"
      }
    },
    "tools": {
      "type": "object",
      "description": "Canonical tool declarations by logical tool name. A declaration may select a local implementing component or an exact published release; all consumers refer to the logical name. The name 'middleware' is reserved for tool middleware declarations and cannot be used as a tool name.",
      "properties": {
        "middleware": {
          "type": "object",
          "additionalProperties": { "$ref": "#/definitions/toolMiddlewareDeclaration" }
        }
      },
      "propertyNames": {
        "pattern": "^[a-z][a-z0-9]*(-[a-z0-9]+)*$"
      },
      "additionalProperties": {
        "$ref": "#/definitions/toolDeclaration"
      }
    },
    "customCommands": {
      "type": "object",
      "description": "User defined custom commands.",
      "additionalProperties": {
        "type": "array",
        "items": {
          "$ref": "#/definitions/externalCommand"
        }
      }
    },
    "clean": {
      "type": "array",
      "description": "User defined extra paths used in the clean command.",
      "items": {
        "type": "string"
      }
    },
    "httpApi": {
      "$ref": "#/definitions/httpApi"
    },
    "mcp": {
      "$ref": "#/definitions/mcp"
    },
    "localServer": {
      "$ref": "#/definitions/localServer"
    },
    "environments": {
      "type": "object",
      "description": "Application environments",
      "additionalProperties": {
        "$ref": "#/definitions/environment"
      }
    },
    "version": {
      "$ref": "#/definitions/appVersionSource",
      "description": "Application-wide default version source, overridable per environment."
    },
    "bridge": {
      "$ref": "#/definitions/bridgeSdks"
    },
    "secretDefaults": {
      "type": "object",
      "description": "Secret defaults by environment name, using nested config-style object paths.",
      "additionalProperties": {
        "type": "object",
        "additionalProperties": {}
      }
    },
    "retryPolicyDefaults": {
      "type": "object",
      "description": "Retry policy defaults by environment name. Policies defined here are created in the environment during deployment if they don't already exist.",
      "additionalProperties": {
        "type": "object",
        "additionalProperties": {
          "$ref": "#/definitions/retryPolicyDefault"
        }
      }
    },
    "resourceDefaults": {
      "type": "object",
      "description": "Quota resource defaults by environment name.",
      "additionalProperties": {
        "type": "object",
        "additionalProperties": {
          "$ref": "#/definitions/resourceDefinitionCreation"
        }
      }
    },
    "toolReleases": {
      "type": "object",
      "description": "Local tools to publish as immutable grantable releases by environment name.",
      "additionalProperties": {
        "type": "object",
        "propertyNames": {
          "pattern": "^[a-z][a-z0-9]*(-[a-z0-9]+)*$"
        },
        "additionalProperties": {
          "type": "object",
          "maxProperties": 0
        }
      }
    },
    "toolMiddlewareReleases": {
      "type": "object",
      "description": "Local tool middlewares to publish as immutable grantable releases by environment name.",
      "additionalProperties": {
        "type": "object",
        "propertyNames": { "pattern": "^[a-z][a-z0-9]*(-[a-z0-9]+)*$" },
        "additionalProperties": { "type": "object", "maxProperties": 0 }
      }
    }
  },
  "definitions": {
    "lenientTokenList": {
      "oneOf": [
        {
          "type": "string"
        },
        {
          "type": "array",
          "items": {
            "type": "string"
          }
        }
      ]
    },
    "templates": {
      "description": "List of parent templates",
      "type": "object",
      "additionalProperties": false,
      "properties": {
        "templates": {
          "$ref": "#/definitions/lenientTokenList"
        }
      }
    },
    "initialCard": {
      "description": "Initial permission card grants installed into newly created agents of this type.",
      "type": "object",
      "additionalProperties": false,
      "properties": {
        "lowerBound": {
          "$ref": "#/definitions/initialCardBound"
        },
        "upperBound": {
          "$ref": "#/definitions/initialCardBound"
        }
      }
    },
    "initialCardBound": {
      "type": "object",
      "additionalProperties": false,
      "properties": {
        "positive": {
          "type": "array",
          "items": {
            "type": "string"
          }
        },
        "negative": {
          "type": "array",
          "items": {
            "type": "string"
          }
        }
      }
    },
    "componentDependencies": {
      "description": "Guest bridge dependencies required by a component. Agent dependencies are always provider-qualified. Tool dependencies may use a declared logical tool name or an explicit provider-qualified reference.",
      "type": "object",
      "additionalProperties": false,
      "properties": {
        "agents": {
          "description": "Agent guest bridge dependencies. Each entry identifies both provider component and agent type, either as 'component/name' or as { component, name }.",
          "type": "array",
          "items": {
            "$ref": "#/definitions/componentDependencyReference"
          }
        },
        "tools": {
          "description": "Tool guest bridge dependencies. A bare logical name is resolved through tools.<name>; an explicit local tool uses 'component/name' or { component, name }.",
          "type": "array",
          "items": {
            "$ref": "#/definitions/componentDependencyReference"
          }
        }
      }
    },
    "nodeHttpRouters": {
      "description": "Build-time Node HTTP listen port mappings. A later component layer replaces the complete table. Ports select logical routers, not sockets.",
      "type": "object",
      "propertyNames": {
        "pattern": "^(?:[1-9][0-9]{0,3}|[1-5][0-9]{4}|6[0-4][0-9]{3}|65[0-4][0-9]{2}|655[0-2][0-9]|6553[0-5])$"
      },
      "additionalProperties": {
        "type": "object",
        "additionalProperties": false,
        "required": ["name", "mount"],
        "properties": {
          "name": { "type": "string", "minLength": 1 },
          "mount": { "type": "string" },
          "auth": { "type": "boolean" },
          "cors": { "type": "array", "items": { "type": "string" } }
        }
      }
    },
    "componentTemplate": {
      "description": "Component template definition",
      "type": "object",
      "additionalProperties": false,
      "properties": {
        "nodeHttpRouters": { "$ref": "#/definitions/nodeHttpRouters" },
        "guestLanguage": {
          "description": "The guest language of the components built with this template. The CLI uses it for language specific features, such as dependency checks, bridge generation and the REPL. Components get it from their applied templates, and applied templates must not declare different languages.",
          "type": "string",
          "enum": ["ts", "effect", "rust", "scala", "moonbit", "go"]
        },
        "toolsMergeMode": {
          "$ref": "#/definitions/mapMergeMode"
        },
        "tools": {
          "$ref": "#/definitions/toolBindings"
        },
        "templates": {
          "$ref": "#/definitions/lenientTokenList"
        },
        "componentWasm": {
          "type": "string",
          "description": "File path for the built WASM component."
        },
        "outputWasm": {
          "type": "string",
          "description": "File path for the output WASM component which is ready to be uploaded to Golem."
        },
        "dependencies": {
          "description": "Guest bridge dependencies required by this component. Agents are provider-qualified; tools may use a logical name from tools or an explicit provider-qualified reference.",
          "$ref": "#/definitions/componentDependencies"
        },
        "buildMergeMode": {
          "$ref": "#/definitions/vecMergeMode"
        },
        "build": {
          "type": "array",
          "description": "Commands used for creating component WASM.",
          "items": {
            "$ref": "#/definitions/buildCommand"
          }
        },
        "customCommands": {
          "type": "object",
          "description": "User defined custom commands.",
          "additionalProperties": {
            "type": "array",
            "items": {
              "$ref": "#/definitions/externalCommand"
            }
          }
        },
        "clean": {
          "type": "array",
          "description": "User defined extra paths used in the clean command.",
          "items": {
            "type": "string"
          }
        },
        "configSchema": {
          "$ref": "#/definitions/componentConfigSchema"
        },
        "config": {},
        "initialCard": {
          "$ref": "#/definitions/initialCard"
        },
        "envMergeMode": {
          "$ref": "#/definitions/mapMergeMode"
        },
        "env": {
          "type": "object",
          "description": "Environment variables for the agent.",
          "additionalProperties": {
            "type": "string"
          }
        },
        "pluginsMergeMode": {
          "$ref": "#/definitions/vecMergeMode"
        },
        "plugins": {
          "type": "array",
          "description": "Installed plugins for the agent",
          "items": {
            "$ref": "#/definitions/pluginInstallation"
          }
        },
        "filesMergeMode": {
          "$ref": "#/definitions/vecMergeMode"
        },
        "files": {
          "type": "array",
          "description": "Initial component file system",
          "items": {
            "$ref": "#/definitions/initialComponentFile"
          }
        },
        "presets": {
          "type": "object",
          "additionalProperties": {
            "$ref": "#/definitions/componentPreset"
          }
        }
      }
    },
    "component": {
      "description": "Component definition",
      "type": "object",
      "additionalProperties": false,
      "properties": {
        "nodeHttpRouters": { "$ref": "#/definitions/nodeHttpRouters" },
        "toolsMergeMode": {
          "$ref": "#/definitions/mapMergeMode"
        },
        "tools": {
          "$ref": "#/definitions/toolBindings"
        },
        "templates": {
          "$ref": "#/definitions/lenientTokenList"
        },
        "dir": {
          "type": "string",
          "description": "Base directory for resolving component paths"
        },
        "componentWasm": {
          "type": "string",
          "description": "File path for the built WASM component."
        },
        "outputWasm": {
          "type": "string",
          "description": "File path for the output WASM component which is ready to be uploaded to Golem."
        },
        "dependencies": {
          "description": "Guest bridge dependencies required by this component. Agents are provider-qualified; tools may use a logical name from tools or an explicit provider-qualified reference.",
          "$ref": "#/definitions/componentDependencies"
        },
        "buildMergeMode": {
          "$ref": "#/definitions/vecMergeMode"
        },
        "build": {
          "type": "array",
          "description": "Commands used for creating component WASM.",
          "items": {
            "$ref": "#/definitions/buildCommand"
          }
        },
        "customCommands": {
          "type": "object",
          "description": "User defined custom commands.",
          "additionalProperties": {
            "type": "array",
            "items": {
              "$ref": "#/definitions/externalCommand"
            }
          }
        },
        "clean": {
          "type": "array",
          "description": "User defined extra paths used in the clean command.",
          "items": {
            "type": "string"
          }
        },
        "configSchema": {
          "$ref": "#/definitions/componentConfigSchema"
        },
        "config": {},
        "initialCard": {
          "$ref": "#/definitions/initialCard"
        },
        "envMergeMode": {
          "$ref": "#/definitions/mapMergeMode"
        },
        "env": {
          "type": "object",
          "description": "Environment variables for the agent.",
          "additionalProperties": {
            "type": "string"
          }
        },
        "pluginsMergeMode": {
          "$ref": "#/definitions/vecMergeMode"
        },
        "plugins": {
          "type": "array",
          "description": "Installed plugins for the agent",
          "items": {
            "$ref": "#/definitions/pluginInstallation"
          }
        },
        "filesMergeMode": {
          "$ref": "#/definitions/vecMergeMode"
        },
        "files": {
          "type": "array",
          "description": "Initial component file system",
          "items": {
            "$ref": "#/definitions/initialComponentFile"
          }
        },
        "presets": {
          "type": "object",
          "additionalProperties": {
            "$ref": "#/definitions/componentPreset"
          }
        }
      }
    },
    "componentLayerProperties": {
      "type": "object",
      "additionalProperties": false,
      "properties": {
        "toolsMergeMode": {
          "$ref": "#/definitions/mapMergeMode"
        },
        "tools": {
          "$ref": "#/definitions/toolBindings"
        },
        "configSchema": {
          "$ref": "#/definitions/componentConfigSchema"
        },
        "config": {},
        "initialCard": {
          "$ref": "#/definitions/initialCard"
        },
        "envMergeMode": {
          "$ref": "#/definitions/mapMergeMode"
        },
        "env": {
          "type": "object",
          "description": "Environment variables for the agent.",
          "additionalProperties": {
            "type": "string"
          }
        },
        "pluginsMergeMode": {
          "$ref": "#/definitions/vecMergeMode"
        },
        "plugins": {
          "type": "array",
          "description": "Installed plugins for the agent",
          "items": {
            "$ref": "#/definitions/pluginInstallation"
          }
        },
        "filesMergeMode": {
          "$ref": "#/definitions/vecMergeMode"
        },
        "files": {
          "type": "array",
          "description": "Initial component file system",
          "items": {
            "$ref": "#/definitions/initialComponentFile"
          }
        },
        "componentWasm": {
          "type": "string",
          "description": "File path for the built WASM component."
        },
        "outputWasm": {
          "type": "string",
          "description": "File path for the output WASM component which is ready to be uploaded to Golem."
        },
        "dependencies": {
          "description": "Guest bridge dependencies required by this component. Agents are provider-qualified; tools may use a logical name from tools or an explicit provider-qualified reference.",
          "$ref": "#/definitions/componentDependencies"
        },
        "buildMergeMode": {
          "$ref": "#/definitions/vecMergeMode"
        },
        "build": {
          "type": "array",
          "description": "Commands used for creating component WASM.",
          "items": {
            "$ref": "#/definitions/buildCommand"
          }
        },
        "customCommands": {
          "type": "object",
          "description": "User defined custom commands.",
          "additionalProperties": {
            "type": "array",
            "items": {
              "$ref": "#/definitions/externalCommand"
            }
          }
        },
        "clean": {
          "type": "array",
          "description": "User defined extra paths used in the clean command.",
          "items": {
            "type": "string"
          }
        }
      }
    },
    "componentPresets": {
      "type": "object",
      "description": "Component definition presets",
      "additionalProperties": false,
      "properties": {
        "presets": {
          "type": "object",
          "additionalProperties": {
            "$ref": "#/definitions/componentPreset"
          }
        }
      }
    },
    "componentPreset": {
      "type": "object",
      "additionalProperties": false,
      "properties": {
        "nodeHttpRouters": { "$ref": "#/definitions/nodeHttpRouters" },
        "configSchema": {
          "$ref": "#/definitions/componentConfigSchema"
        },
        "toolsMergeMode": {
          "$ref": "#/definitions/mapMergeMode"
        },
        "tools": {
          "$ref": "#/definitions/toolBindings"
        },
        "config": {},
        "initialCard": {
          "$ref": "#/definitions/initialCard"
        },
        "envMergeMode": {
          "$ref": "#/definitions/mapMergeMode"
        },
        "env": {
          "type": "object",
          "description": "Environment variables for the agent.",
          "additionalProperties": {
            "type": "string"
          }
        },
        "pluginsMergeMode": {
          "$ref": "#/definitions/vecMergeMode"
        },
        "plugins": {
          "type": "array",
          "description": "Installed plugins for the agent",
          "items": {
            "$ref": "#/definitions/pluginInstallation"
          }
        },
        "filesMergeMode": {
          "$ref": "#/definitions/vecMergeMode"
        },
        "files": {
          "type": "array",
          "description": "Initial component file system",
          "items": {
            "$ref": "#/definitions/initialComponentFile"
          }
        },
        "componentWasm": {
          "type": "string",
          "description": "File path for the built WASM component."
        },
        "outputWasm": {
          "type": "string",
          "description": "File path for the output WASM component which is ready to be uploaded to Golem."
        },
        "dependencies": {
          "description": "Guest bridge dependencies required by this component. Agents are provider-qualified; tools may use a logical name from tools or an explicit provider-qualified reference.",
          "$ref": "#/definitions/componentDependencies"
        },
        "buildMergeMode": {
          "$ref": "#/definitions/vecMergeMode"
        },
        "build": {
          "type": "array",
          "description": "Commands used for creating component WASM.",
          "items": {
            "$ref": "#/definitions/buildCommand"
          }
        },
        "customCommands": {
          "type": "object",
          "description": "User defined custom commands.",
          "additionalProperties": {
            "type": "array",
            "items": {
              "$ref": "#/definitions/externalCommand"
            }
          }
        },
        "clean": {
          "type": "array",
          "description": "User defined extra paths used in the clean command.",
          "items": {
            "type": "string"
          }
        },
        "default": {
          "const": true
        }
      }
    },
    "agent": {
      "description": "Agent definition",
      "type": "object",
      "additionalProperties": false,
      "properties": {
        "templates": {
          "$ref": "#/definitions/lenientTokenList"
        },
        "config": {},
        "initialCard": {
          "$ref": "#/definitions/initialCard"
        },
        "envMergeMode": {
          "$ref": "#/definitions/mapMergeMode"
        },
        "env": {
          "type": "object",
          "description": "Environment variables for the agent.",
          "additionalProperties": {
            "type": "string"
          }
        },
        "pluginsMergeMode": {
          "$ref": "#/definitions/vecMergeMode"
        },
        "plugins": {
          "type": "array",
          "description": "Installed plugins for the agent",
          "items": {
            "$ref": "#/definitions/pluginInstallation"
          }
        },
        "filesMergeMode": {
          "$ref": "#/definitions/vecMergeMode"
        },
        "files": {
          "type": "array",
          "description": "Initial component file system",
          "items": {
            "$ref": "#/definitions/initialComponentFile"
          }
        },
        "toolsMergeMode": {
          "$ref": "#/definitions/mapMergeMode"
        },
        "tools": {
          "$ref": "#/definitions/toolBindings"
        },
        "presets": {
          "type": "object",
          "additionalProperties": {
            "$ref": "#/definitions/agentPreset"
          }
        }
      }
    },
    "agentPreset": {
      "type": "object",
      "additionalProperties": false,
      "properties": {
        "config": {},
        "initialCard": {
          "$ref": "#/definitions/initialCard"
        },
        "envMergeMode": {
          "$ref": "#/definitions/mapMergeMode"
        },
        "env": {
          "type": "object",
          "description": "Environment variables for the agent.",
          "additionalProperties": {
            "type": "string"
          }
        },
        "pluginsMergeMode": {
          "$ref": "#/definitions/vecMergeMode"
        },
        "plugins": {
          "type": "array",
          "description": "Installed plugins for the agent",
          "items": {
            "$ref": "#/definitions/pluginInstallation"
          }
        },
        "filesMergeMode": {
          "$ref": "#/definitions/vecMergeMode"
        },
        "files": {
          "type": "array",
          "description": "Initial component file system",
          "items": {
            "$ref": "#/definitions/initialComponentFile"
          }
        },
        "toolsMergeMode": {
          "$ref": "#/definitions/mapMergeMode"
        },
        "tools": {
          "$ref": "#/definitions/toolBindings"
        },
        "default": {
          "const": true
        }
      }
    },
    "agentLayerProperties": {
      "type": "object",
      "additionalProperties": false,
      "properties": {
        "config": {},
        "initialCard": {
          "$ref": "#/definitions/initialCard"
        },
        "envMergeMode": {
          "$ref": "#/definitions/mapMergeMode"
        },
        "env": {
          "type": "object",
          "description": "Environment variables for the agent.",
          "additionalProperties": {
            "type": "string"
          }
        },
        "pluginsMergeMode": {
          "$ref": "#/definitions/vecMergeMode"
        },
        "plugins": {
          "type": "array",
          "description": "Installed plugins for the agent",
          "items": {
            "$ref": "#/definitions/pluginInstallation"
          }
        },
        "filesMergeMode": {
          "$ref": "#/definitions/vecMergeMode"
        },
        "files": {
          "type": "array",
          "description": "Initial component file system",
          "items": {
            "$ref": "#/definitions/initialComponentFile"
          }
        },
        "toolsMergeMode": {
          "$ref": "#/definitions/mapMergeMode"
        },
        "tools": {
          "$ref": "#/definitions/toolBindings"
        }
      }
    },
    "toolDeclaration": {
      "description": "Canonical identity and consumer-owned provision properties for a tool. Omit both component and release for an implicitly discovered local implementation, select a local implementing component, or select an exact published release. Deploy automatically reconciles the required environment grant.",
      "type": "object",
      "additionalProperties": false,
      "not": {
        "required": [
          "component",
          "release"
        ]
      },
      "properties": {
        "component": {
          "type": "string",
          "description": "Component implementing this local tool. Use this when multiple components export a tool with the same name or when referring to the declaration as a name-only component dependency."
        },
        "release": {
          "$ref": "#/definitions/registrySubject"
        },
        "templates": {
          "$ref": "#/definitions/lenientTokenList"
        },
        "config": {},
        "envMergeMode": {
          "$ref": "#/definitions/mapMergeMode"
        },
        "env": {
          "type": "object",
          "additionalProperties": {
            "type": "string"
          }
        },
        "pluginsMergeMode": {
          "$ref": "#/definitions/vecMergeMode"
        },
        "plugins": {
          "type": "array",
          "items": {
            "$ref": "#/definitions/pluginInstallation"
          }
        },
        "filesMergeMode": {
          "$ref": "#/definitions/vecMergeMode"
        },
        "files": {
          "type": "array",
          "items": {
            "$ref": "#/definitions/initialComponentFile"
          }
        },
        "presets": {
          "type": "object",
          "additionalProperties": {
            "$ref": "#/definitions/toolPreset"
          }
        }
      }
    },
    "toolPreset": {
      "description": "Named tool provision-property preset",
      "type": "object",
      "additionalProperties": false,
      "properties": {
        "default": {
          "const": true
        },
        "config": {},
        "envMergeMode": {
          "$ref": "#/definitions/mapMergeMode"
        },
        "env": {
          "type": "object",
          "additionalProperties": {
            "type": "string"
          }
        },
        "pluginsMergeMode": {
          "$ref": "#/definitions/vecMergeMode"
        },
        "plugins": {
          "type": "array",
          "items": {
            "$ref": "#/definitions/pluginInstallation"
          }
        },
        "filesMergeMode": {
          "$ref": "#/definitions/vecMergeMode"
        },
        "files": {
          "type": "array",
          "items": {
            "$ref": "#/definitions/initialComponentFile"
          }
        }
      }
    },
    "toolBindings": {
      "type": "object",
      "description": "Source-neutral bindings by tool name",
      "propertyNames": {
        "pattern": "^[a-z][a-z0-9]*(-[a-z0-9]+)*$"
      },
      "additionalProperties": {
        "$ref": "#/definitions/toolBinding"
      }
    },
    "toolBinding": {
      "type": "object",
      "additionalProperties": false,
      "properties": {
        "version": {
          "type": "string"
        },
        "parametersMergeMode": {
          "$ref": "#/definitions/mapMergeMode"
        },
        "parameters": {
          "type": "object",
          "additionalProperties": {}
        },
        "account": {
          "type": "string"
        },
        "configKeysReadableMergeMode": {
          "$ref": "#/definitions/secretKeyMergeMode"
        },
        "configKeysReadable": {
          "$ref": "#/definitions/configKeyScope"
        },
        "secretKeysReadableMergeMode": {
          "$ref": "#/definitions/secretKeyMergeMode"
        },
        "secretKeysReadable": {
          "$ref": "#/definitions/secretKeyScope"
        },
        "secretKeysRevealableMergeMode": {
          "$ref": "#/definitions/secretKeyMergeMode"
        },
        "secretKeysRevealable": {
          "$ref": "#/definitions/secretKeyScope"
        },
        "filesystemAccess": {
          "$ref": "#/definitions/toolFilesystemAccess"
        },
        "middleware": {
          "type": "array",
          "items": { "$ref": "#/definitions/toolMiddlewareInstallation" }
        },
        "middlewareMergeMode": {
          "$ref": "#/definitions/toolMiddlewareMergeMode"
        }
      }
    },
    "environmentToolBinding": {
      "allOf": [
        { "$ref": "#/definitions/toolBinding" },
        {
          "not": { "required": ["middlewareMergeMode"] }
        }
      ]
    },
    "toolMiddlewareInstallation": {
      "oneOf": [
        { "type": "string" },
        {
          "type": "object", "additionalProperties": false, "required": ["name"],
          "properties": {
            "name": { "type": "string", "pattern": "^[a-z][a-z0-9]*(-[a-z0-9]+)*$" },
            "version": { "type": "string" }, "parameters": {}, "account": { "type": "string" },
            "secretKeysReadable": { "$ref": "#/definitions/secretKeyScope" },
            "secretKeysRevealable": { "$ref": "#/definitions/secretKeyScope" },
            "filesystemAccess": { "$ref": "#/definitions/toolFilesystemAccess" }
          }
        }
      ]
    },
    "toolMiddlewareMergeMode": { "enum": ["prepend", "append", "replace"] },
    "toolFilesystemAccess": { "enum": ["unset", "allowed", "denied"] },
    "environmentTools": {
      "type": "object",
      "properties": {
        "middleware": { "type": "array", "items": { "$ref": "#/definitions/toolMiddlewareInstallation" } },
        "defaults": {
          "oneOf": [
            { "const": "*" },
            { "type": "array", "items": { "type": "string", "not": { "const": "*" } } }
          ],
          "default": "*",
          "description": "The default built-in tools that the CLI adds to every deployment of this environment and binds to every agent type: `\"*\"` for all of them, `[]` for none, or a list of their names. `bash`, with access to the agent's files, is the only default tool now. A binding with the name of a default tool in this object sets what that tool may read. A tool that the manifest declares under `tools` is never replaced."
        }
      },
      "additionalProperties": { "$ref": "#/definitions/environmentToolBinding" }
    },
    "secretKeyMergeMode": {
      "type": "string",
      "enum": [
        "intersect"
      ]
    },
    "configKeyScope": {
      "oneOf": [
        {
          "const": "*"
        },
        {
          "type": "array",
          "items": {
            "type": "string",
            "not": {
              "const": "*"
            }
          }
        }
      ]
    },
    "secretKeyScope": {
      "oneOf": [
        {
          "const": "*"
        },
        {
          "type": "array",
          "items": {
            "type": "string",
            "not": {
              "const": "*"
            }
          }
        }
      ]
    },
    "httpApi": {
      "type": "object",
      "additionalProperties": false,
      "description": "HTTP API deployments",
      "properties": {
        "deployments": {
          "type": "object",
          "description": "HTTP API deployments by environments",
          "additionalProperties": {
            "type": "array",
            "items": {
              "$ref": "#/definitions/httpApiDeployment"
            }
          }
        }
      }
    },
    "httpApiDeployment": {
      "type": "object",
      "additionalProperties": false,
      "description": "HTTP API deployment",
      "properties": {
        "scheme": {
          "type": "string",
          "enum": ["http", "https"],
          "description": "Public scheme advertised in OpenAPI. Does not configure the HTTP listener. Defaults to http for built-in local and implicit local environments, and https for built-in cloud environments. Custom server environments must set this field explicitly; their management URL scheme is not used."
        },
        "domain": {
          "type": "string",
          "description": "Full concrete domain for the HTTP API deployment. Use this for custom domains and custom server environments."
        },
        "subdomain": {
          "type": "string",
          "description": "Single DNS label resolved through the deployment environment's built-in server. For local HTTP API deployments this resolves to <subdomain>.localhost:9006 by default, or <subdomain>.localhost:<customRequestPort> when localServer.customRequestPort is set to a stable nonzero port. For cloud HTTP API deployments this resolves to <subdomain>.apps.golem.cloud."
        },
        "webhookUrl": {
          "type": "string",
          "description": "Webhook URL prefix"
        },
        "openapiEndpoint": {
          "type": "string",
          "description": "OpenApi endpoint URL prefix"
        },
        "agents": {
          "type": "object",
          "description": "HTTP API deployment options by agent type name",
          "additionalProperties": {
            "$ref": "#/definitions/httpApiDeploymentAgentOptions"
          }
        }
      },
      "oneOf": [
        {
          "required": [
            "domain"
          ]
        },
        {
          "required": [
            "subdomain"
          ]
        }
      ]
    },
    "httpApiDeploymentAgentOptions": {
      "type": "object",
      "additionalProperties": false,
      "properties": {
        "securityScheme": {
          "type": "string"
        },
        "testSessionHeaderName": {
          "type": "string"
        }
      }
    },
    "mcp": {
      "type": "object",
      "additionalProperties": false,
      "description": "MCP deployments",
      "properties": {
        "deployments": {
          "type": "object",
          "description": "MCP deployments by environments",
          "additionalProperties": {
            "type": "array",
            "items": {
              "$ref": "#/definitions/mcpDeployment"
            }
          }
        },
        "imports": {
          "type": "object",
          "description": "Ordered MCP imports by environment",
          "additionalProperties": {
            "type": "array",
            "items": {
              "$ref": "#/definitions/mcpImport"
            }
          }
        }
      }
    },
    "mcpImport": {
      "type": "object",
      "additionalProperties": false,
      "required": ["url"],
      "allOf": [
        { "not": { "required": ["auth", "securityScheme"] } },
        { "not": { "required": ["include", "exclude"] } }
      ],
      "properties": {
        "name": {
          "type": "string",
          "pattern": "^[a-z][a-z0-9_-]*$",
          "description": "Optional CLI name, unique within the environment. Commands can also select an import by its unique full URL. Names are not sent to the server."
        },
        "url": { "type": "string" },
        "auth": { "$ref": "#/definitions/mcpImportAuth" },
        "securityScheme": { "type": "string" },
        "prefix": { "type": "string" },
        "include": { "type": "array", "items": { "type": "string" } },
        "exclude": { "type": "array", "items": { "type": "string" } },
        "version": { "type": "string" }
      }
    },
    "mcpImportAuth": {
      "type": "object",
      "additionalProperties": false,
      "oneOf": [{ "required": ["bearer"] }, { "required": ["basic"] }],
      "properties": {
        "bearer": { "type": "string" },
        "basic": { "$ref": "#/definitions/mcpImportBasicAuth" }
      }
    },
    "mcpImportBasicAuth": {
      "type": "object",
      "additionalProperties": false,
      "required": ["user", "password"],
      "properties": {
        "user": { "type": "string" },
        "password": { "type": "string" }
      }
    },
    "mcpDeployment": {
      "type": "object",
      "additionalProperties": false,
      "properties": {
        "domain": {
          "type": "string",
          "description": "Full concrete domain for the MCP deployment. Use this for custom domains and custom server environments."
        },
        "subdomain": {
          "type": "string",
          "description": "Single DNS label resolved through the deployment environment's built-in server. For local MCP deployments this resolves to <subdomain>.localhost:9007 by default, or <subdomain>.localhost:<mcpPort> when localServer.mcpPort is set to a stable nonzero port. For cloud MCP deployments this resolves to <subdomain>.mcps.golem.cloud."
        },
        "agents": {
          "type": "object",
          "additionalProperties": {
            "$ref": "#/definitions/mcpDeploymentAgentOptions"
          }
        },
        "tools": {
          "type": "object",
          "additionalProperties": {
            "$ref": "#/definitions/mcpDeploymentToolOptions"
          }
        }
      },
      "oneOf": [
        {
          "required": [
            "domain"
          ]
        },
        {
          "required": [
            "subdomain"
          ]
        }
      ],
      "anyOf": [
        { "required": ["agents"], "properties": { "agents": { "minProperties": 1 } } },
        { "required": ["tools"], "properties": { "tools": { "minProperties": 1 } } }
      ]
    },
    "mcpDeploymentAgentOptions": {
      "type": "object",
      "additionalProperties": false,
      "properties": {
        "securityScheme": {
          "type": "string"
        }
      }
    },
    "mcpDeploymentToolOptions": {
      "type": "object",
      "additionalProperties": false,
      "required": ["ownerComponent"],
      "properties": {
        "ownerComponent": { "type": "string" },
        "securityScheme": { "type": "string" },
        "include": { "type": "array", "items": { "type": "string" } },
        "exclude": { "type": "array", "items": { "type": "string" } }
      },
      "not": { "required": ["include", "exclude"] }
    },
    "localServer": {
      "type": "object",
      "description": "Configuration for the built-in local preset. `golem server run` uses these settings to run the local server, other `golem` commands use the router address and port to connect to it, and `golem server clean` uses the data directory.",
      "additionalProperties": false,
      "properties": {
        "routerAddr": {
          "type": "string",
          "description": "Address where `golem server run` serves the built-in local preset's main API. Other `golem` commands targeting the preset connect to this address; `0.0.0.0` is translated to `127.0.0.1` when connecting. Must be an IPv4 address literal, such as `127.0.0.1` or `0.0.0.0`; host names are not supported. Defaults to `127.0.0.1`. The server refuses to bind an address that is not loopback while the configuration uses a well-known default secret, such as the local admin token."
        },
        "routerPort": {
          "type": "integer",
          "minimum": 1,
          "maximum": 65535,
          "description": "Port where `golem server run` serves the built-in local preset's main API and where other `golem` commands targeting the preset connect. Do not set this to 0 in the manifest; port 0 is only allowed when passed directly as --router-port 0 to golem server run."
        },
        "customRequestPort": {
          "type": "integer",
          "minimum": 1,
          "maximum": 65535,
          "description": "Port to serve custom requests on. Do not set this to 0 in the manifest; port 0 is only allowed when passed directly as --custom-request-port 0 to golem server run."
        },
        "mcpPort": {
          "type": "integer",
          "minimum": 1,
          "maximum": 65535,
          "description": "Port to serve the MCP server on. Do not set this to 0 in the manifest; port 0 is only allowed when passed directly as --mcp-port 0 to golem server run."
        },
        "portsFile": {
          "type": "string",
          "description": "Path where discovered startup ports are written as JSON."
        },
        "dataDir": {
          "type": "string",
          "description": "Directory used by `golem server run` for local server data and removed by `golem server clean`."
        },
        "systemMemoryOverride": {
          "type": "string",
          "minLength": 1,
          "description": "Positive system memory override for local agent admission and eviction, e.g. 2GiB or 500MB. Units are case-insensitive: MB means 1000000 bytes and MiB means 1048576 bytes. Overridden by worker_executor.memory.system_memory_override in the `golem server run --config` file, then by the GOLEM__WORKER_EXECUTOR__MEMORY__SYSTEM_MEMORY_OVERRIDE environment variable, then by --system-memory-override. The executor reserves 20% for host overhead; this is not a hard process RSS limit. When unset, Golem detects the memory limit from the host or cgroup."
        },
        "agentFilesystemRoot": {
          "type": "string",
          "description": "Root directory for deterministic agent filesystem directories."
        }
      }
    },
    "environment": {
      "type": "object",
      "additionalProperties": false,
      "properties": {
        "default": {
          "const": true,
          "description": "Use as default environment, only one can be selected, if missing, the first environment is used as default"
        },
        "account": {
          "type": "string",
          "description": "Optional account that owns the application environment."
        },
        "server": {
          "$ref": "#/definitions/server"
        },
        "componentPresets": {
          "$ref": "#/definitions/lenientTokenList"
        },
        "cli": {
          "$ref": "#/definitions/cliOptions"
        },
        "deployment": {
          "$ref": "#/definitions/deploymentOptions"
        },
        "version": {
          "$ref": "#/definitions/appVersionSourceOverride",
          "description": "Per-environment override, layered over the application-wide version source."
        },
        "tools": {
          "$ref": "#/definitions/environmentTools"
        }
      }
    },
    "server": {
      "description": "Server for the environment, can be either the built-in local/cloud servers, or a custom one.",
      "oneOf": [
        {
          "const": "local"
        },
        {
          "const": "cloud"
        },
        {
          "$ref": "#/definitions/customServer"
        }
      ]
    },
    "customServer": {
      "type": "object",
      "additionalProperties": false,
      "properties": {
        "url": {
          "type": "string",
          "description": "Custom URL for golem services"
        },
        "workerUrl": {
          "type": "string",
          "description": "Custom URL for golem worker service"
        },
        "allowInsecure": {
          "type": "boolean",
          "description": "Allow insecure connections to the server"
        },
        "auth": {
          "$ref": "#/definitions/customServerAuth"
        }
      },
      "required": [
        "url",
        "auth"
      ]
    },
    "customServerAuth": {
      "oneOf": [
        {
          "type": "object",
          "additionalProperties": false,
          "properties": {
            "oauth2": {
              "const": true
            }
          },
          "required": [
            "oauth2"
          ]
        },
        {
          "type": "object",
          "additionalProperties": false,
          "properties": {
            "staticToken": {
              "type": "string"
            }
          },
          "required": [
            "staticToken"
          ]
        }
      ]
    },
    "cliOptions": {
      "type": "object",
      "additionalProperties": false,
      "properties": {
        "format": {
          "enum": [
            "text",
            "json",
            "yaml",
            "pretty",
            "pretty-json",
            "pretty-yaml",
            "toon"
          ],
          "description": "Default output format"
        },
        "autoConfirm": {
          "const": true,
          "description": "Enables auto-confirm (yes) flag by default"
        },
        "redeployAgents": {
          "const": true,
          "description": "Enables redeploy-agents flag by default"
        },
        "reset": {
          "const": true,
          "description": "Enables reset flag by default"
        }
      }
    },
    "deploymentOptions": {
      "type": "object",
      "additionalProperties": false,
      "properties": {
        "compatibilityCheck": {
          "type": "boolean"
        },
        "toolCompatibilityMode": {
          "enum": ["strict-equality", "structural-subtype", "nominal"]
        },
        "versionCheck": {
          "type": "boolean"
        },
        "securityOverrides": {
          "type": "boolean"
        }
      }
    },
    "appVersionSource": {
      "description": "How the logical version attached to a deployment is computed: a literal version string, or a git/env source.",
      "oneOf": [
        {
          "type": "string",
          "description": "Literal version string."
        },
        {
          "type": "object",
          "additionalProperties": false,
          "properties": {
            "git": {
              "$ref": "#/definitions/gitVersionSource"
            }
          },
          "required": [
            "git"
          ]
        },
        {
          "type": "object",
          "additionalProperties": false,
          "properties": {
            "env": {
              "type": "string",
              "description": "Name of the environment variable to read the version from."
            }
          },
          "required": [
            "env"
          ]
        }
      ]
    },
    "gitVersionSource": {
      "description": "Git version source: either hash mode (hashOnly) or tag mode (the tag options); the two are mutually exclusive.",
      "oneOf": [
        {
          "type": "object",
          "additionalProperties": false,
          "required": [
            "hashOnly"
          ],
          "properties": {
            "hashOnly": {
              "const": true,
              "description": "Use the short commit hash as the version, ignoring tags."
            },
            "allowDirty": {
              "type": "boolean",
              "description": "Allow deploying with a dirty working tree, appending a '-dirty' marker. Default: false."
            },
            "staticFallback": {
              "type": "string",
              "description": "Static version used when git cannot supply one (no git, no repo). Absent means those cases are errors."
            }
          }
        },
        {
          "type": "object",
          "additionalProperties": false,
          "required": [
            "tagPattern"
          ],
          "properties": {
            "tagPattern": {
              "type": "string",
              "description": "Only consider tags matching this glob (git describe --match); use '*' for all tags."
            },
            "commitInfo": {
              "type": "boolean",
              "description": "Append '-<commits-since-tag>-g<hash>' when HEAD is past the tag. Default: true."
            },
            "hashFallback": {
              "type": "boolean",
              "description": "When no matching tag is found, use the short commit hash instead of staticFallback. Default: false."
            },
            "allowDirty": {
              "type": "boolean",
              "description": "Allow deploying with a dirty working tree, appending a '-dirty' marker. Default: false."
            },
            "staticFallback": {
              "type": "string",
              "description": "Static version used when git cannot supply one (no git, no repo, or no tag without hashFallback). Absent means those cases are errors."
            }
          }
        }
      ]
    },
    "appVersionSourceOverride": {
      "description": "Per-environment version override: same shapes as the root version, with all fields optional.",
      "oneOf": [
        {
          "type": "string",
          "description": "Literal version string."
        },
        {
          "type": "object",
          "additionalProperties": false,
          "properties": {
            "git": {
              "$ref": "#/definitions/gitVersionSourceOverride"
            }
          },
          "required": [
            "git"
          ]
        },
        {
          "type": "object",
          "additionalProperties": false,
          "properties": {
            "env": {
              "type": "string"
            }
          },
          "required": [
            "env"
          ]
        }
      ]
    },
    "gitVersionSourceOverride": {
      "description": "Git version override: hash mode (hashOnly) or a partial tag-mode override (tagPattern optional).",
      "oneOf": [
        {
          "type": "object",
          "additionalProperties": false,
          "required": [
            "hashOnly"
          ],
          "properties": {
            "hashOnly": {
              "const": true
            },
            "allowDirty": {
              "type": "boolean"
            },
            "staticFallback": {
              "type": "string"
            }
          }
        },
        {
          "type": "object",
          "additionalProperties": false,
          "properties": {
            "tagPattern": {
              "type": "string"
            },
            "commitInfo": {
              "type": "boolean"
            },
            "hashFallback": {
              "type": "boolean"
            },
            "allowDirty": {
              "type": "boolean"
            },
            "staticFallback": {
              "type": "string"
            }
          }
        }
      ]
    },
    "buildCommand": {
      "oneOf": [
        {
          "$ref": "#/definitions/externalCommand"
        },
        {
          "$ref": "#/definitions/generateQuickJsCrateCommand"
        },
        {
          "$ref": "#/definitions/generateQuickJsdtsCommand"
        },
        {
          "$ref": "#/definitions/injectToPrebuiltQuickjsCommand"
        },
        {
          "$ref": "#/definitions/preinitializeJsCommand"
        }
      ]
    },
    "externalCommand": {
      "type": "object",
      "additionalProperties": false,
      "description": "External command with optional inputs and outputs with up-to-date checks",
      "properties": {
        "command": {
          "type": "string",
          "description": "External command to execute"
        },
        "dir": {
          "type": "string",
          "description": "Working directory for the command"
        },
        "env": {
          "type": "object",
          "description": "Environment variables for the command",
          "additionalProperties": {
            "type": "string"
          }
        },
        "rmdirs": {
          "type": "array",
          "description": "List of directories that should be deleted before running the command, runs before mkdirs.",
          "items": {
            "type": "string"
          }
        },
        "mkdirs": {
          "type": "array",
          "description": "List of directories that should be created before running the command, runs after rmdirs.",
          "items": {
            "type": "string"
          }
        },
        "sources": {
          "type": "array",
          "description": "Inputs (paths and globs) for the external command",
          "items": {
            "type": "string"
          }
        },
        "targets": {
          "type": "array",
          "description": "Outputs (paths and globs) for the external command",
          "items": {
            "type": "string"
          }
        }
      },
      "required": [
        "command"
      ]
    },
    "generateQuickJsCrateCommand": {
      "type": "object",
      "additionalProperties": false,
      "description": "Generate QuickJS crate",
      "properties": {
        "generateQuickjsCrate": {
          "type": "string",
          "description": "QuickJS crate path"
        },
        "wit": {
          "type": "string",
          "description": "WIT directory"
        },
        "jsModules": {
          "type": "object",
          "description": "JS module paths and modes",
          "additionalProperties": {
            "type": "string"
          }
        },
        "world": {
          "type": "string",
          "description": "Optional WIT world"
        }
      },
      "required": [
        "generateQuickjsCrate",
        "wit",
        "jsModules"
      ]
    },
    "generateQuickJsdtsCommand": {
      "type": "object",
      "additionalProperties": false,
      "description": "Generate QuickJS d.ts",
      "properties": {
        "generateQuickjsDts": {
          "type": "string",
          "description": "QuickJS d.ts path"
        },
        "wit": {
          "type": "string",
          "description": "WIT directory"
        },
        "world": {
          "type": "string",
          "description": "Optional WIT world"
        }
      },
      "required": [
        "generateQuickjsDts",
        "wit"
      ]
    },
    "injectToPrebuiltQuickjsCommand": {
      "type": "object",
      "additionalProperties": false,
      "description": "Inject JS to prebuilt QuickJS",
      "properties": {
        "injectToPrebuiltQuickjs": {
          "type": "string",
          "description": "Path to the prebuilt QuickJS WASM file that loads a JS module through a get-script import"
        },
        "module": {
          "type": "string",
          "description": "Path to the JS module"
        },
        "into": {
          "type": "string",
          "description": "Path to the output WASM component containing the injected JS module"
        }
      },
      "required": [
        "injectToPrebuiltQuickjs",
        "module",
        "into"
      ]
    },
    "preinitializeJsCommand": {
      "type": "object",
      "additionalProperties": false,
      "description": "Preinitialize JS runtime",
      "properties": {
        "preinitializeJs": {
          "type": "string",
          "description": "Path to the input WASM component to pre-initialize"
        },
        "into": {
          "type": "string",
          "description": "Path to the pre-initialized output WASM component"
        }
      },
      "required": [
        "preinitializeJs",
        "into"
      ]
    },
    "initialComponentFile": {
      "type": "object",
      "additionalProperties": false,
      "description": "File entry for the initial component file system.",
      "properties": {
        "sourcePath": {
          "type": "string",
          "description": "Source path for the component file: either a local file or a URL."
        },
        "targetPath": {
          "type": "string",
          "description": "Target path for the component file, must be an absolute path"
        },
        "permissions": {
          "enum": [
            "read-only",
            "read-write"
          ],
          "description": "Permission for the component file"
        }
      },
      "required": [
        "sourcePath",
        "targetPath"
      ]
    },
    "pluginInstallation": {
      "type": "object",
      "additionalProperties": false,
      "description": "Represents an installed plugin",
      "properties": {
        "account": {
          "type": "string",
          "description": "Account of the plugin"
        },
        "name": {
          "type": "string",
          "description": "Name of the plugin"
        },
        "version": {
          "type": "string",
          "description": "Version of the plugin"
        },
        "parameters": {
          "type": "object",
          "description": "Key-value pairs for configuring the plugin installation",
          "additionalProperties": {
            "type": "string"
          }
        }
      },
      "required": [
        "name",
        "version"
      ]
    },
    "toolMiddlewareDeclaration": {
      "description": "Canonical declaration and provision properties for a tool middleware.",
      "type": "object", "additionalProperties": false,
      "not": { "required": ["component", "release"] },
      "properties": {
        "component": { "type": "string" },
        "release": { "$ref": "#/definitions/toolMiddlewareRegistrySubject" },
        "templates": { "$ref": "#/definitions/lenientTokenList" },
        "config": {}, "envMergeMode": { "$ref": "#/definitions/mapMergeMode" },
        "env": { "type": "object", "additionalProperties": { "type": "string" } },
        "pluginsMergeMode": { "$ref": "#/definitions/vecMergeMode" },
        "plugins": { "type": "array", "items": { "$ref": "#/definitions/pluginInstallation" } },
        "filesMergeMode": { "$ref": "#/definitions/vecMergeMode" },
        "files": { "type": "array", "items": { "$ref": "#/definitions/initialComponentFile" } },
        "presets": { "type": "object", "additionalProperties": { "$ref": "#/definitions/toolPreset" } }
      }
    },
    "toolMiddlewareRegistrySubject": {
      "$ref": "#/definitions/registrySubject"
    },
    "bridgeSdks": {
      "description": "Bridge SDK generator configuration",
      "type": "object",
      "additionalProperties": false,
      "properties": {
        "ts": {
          "description": "TypeScript SDK configuration",
          "$ref": "#/definitions/bridgeSdkLanguageTargets"
        },
        "effect": {
          "description": "Effect SDK configuration",
          "$ref": "#/definitions/bridgeSdkLanguageTargets"
        },
        "rust": {
          "description": "Rust SDK configuration",
          "$ref": "#/definitions/rustBridgeSdkLanguageTargets"
        },
        "scala": {
          "description": "Scala SDK configuration",
          "$ref": "#/definitions/bridgeSdkLanguageTargets"
        },
        "moonbit": {
          "description": "MoonBit SDK configuration",
          "$ref": "#/definitions/bridgeSdkLanguageTargets"
        },
        "go": {
          "description": "Go SDK configuration",
          "$ref": "#/definitions/bridgeSdkLanguageTargets"
        }
      }
    },
    "bridgeSdkLanguageTargets": {
      "description": "Bridge SDK language targets",
      "type": "object",
      "additionalProperties": false,
      "properties": {
        "external": {
          "description": "External bridge SDK configuration for use outside Golem components",
          "$ref": "#/definitions/bridgeSdkExternalTargets"
        },
        "internal": {
          "description": "Internal bridge SDK configuration for use inside Golem components",
          "$ref": "#/definitions/bridgeSdkInternalTargets"
        }
      }
    },
    "rustBridgeSdkLanguageTargets": {
      "description": "Rust bridge SDK language targets",
      "type": "object",
      "additionalProperties": false,
      "properties": {
        "external": { "$ref": "#/definitions/rustBridgeSdkExternalTargets" },
        "internal": { "$ref": "#/definitions/rustBridgeSdkInternalTargets" }
      }
    },
    "rustBridgeSdkExternalTargets": {
      "type": "object",
      "additionalProperties": false,
      "properties": {
        "agents": { "$ref": "#/definitions/lenientTokenList" },
        "outputDir": { "type": "string" },
        "additionalDerives": { "type": "array", "items": { "type": "string" } },
        "additionalDependencies": {
          "type": "object",
          "additionalProperties": { "$ref": "#/definitions/rustBridgeDependency" }
        }
      }
    },
    "rustBridgeSdkInternalTargets": {
      "type": "object",
      "additionalProperties": false,
      "properties": {
        "agents": { "$ref": "#/definitions/lenientTokenList" },
        "tools": { "$ref": "#/definitions/lenientTokenList" },
        "outputDir": { "type": "string" },
        "additionalDerives": { "type": "array", "items": { "type": "string" } },
        "additionalDependencies": {
          "type": "object",
          "additionalProperties": { "$ref": "#/definitions/rustBridgeDependency" }
        }
      }
    },
    "rustBridgeDependency": {
      "oneOf": [
        { "type": "string" },
        {
          "type": "object",
          "additionalProperties": false,
          "properties": {
            "version": { "type": "string" },
            "path": { "type": "string" },
            "git": { "type": "string" },
            "package": { "type": "string" },
            "features": { "type": "array", "items": { "type": "string" } },
            "defaultFeatures": { "type": "boolean" },
            "branch": { "type": "string" },
            "tag": { "type": "string" },
            "rev": { "type": "string" }
          },
          "oneOf": [
            { "required": ["version"] },
            { "required": ["path"] },
            { "required": ["git"] }
          ],
          "allOf": [
            { "if": { "anyOf": [{ "required": ["branch"] }, { "required": ["tag"] }, { "required": ["rev"] }] }, "then": { "required": ["git"] } },
            { "not": { "required": ["branch", "tag"] } },
            { "not": { "required": ["branch", "rev"] } },
            { "not": { "required": ["tag", "rev"] } }
          ]
        }
      ]
    },
    "bridgeSdkExternalTargets": {
      "description": "External bridge SDK mode targets",
      "type": "object",
      "additionalProperties": false,
      "properties": {
        "agents": {
          "description": "List of agent type names, component names or \"*\" for including all agents",
          "$ref": "#/definitions/lenientTokenList"
        },
        "outputDir": {
          "description": "Custom output directory for the generated SDK",
          "type": "string"
        }
      }
    },
    "bridgeSdkInternalTargets": {
      "description": "Internal bridge SDK targets",
      "type": "object",
      "additionalProperties": false,
      "properties": {
        "agents": {
          "description": "List of agent type names, component names or \"*\" for including all agents",
          "$ref": "#/definitions/lenientTokenList"
        },
        "outputDir": {
          "description": "Custom output directory for the generated SDK",
          "type": "string"
        },
        "tools": {
          "description": "Logical tool names, local component matchers, or \"*\". Registry sources are resolved from the canonical declarations under tools.",
          "$ref": "#/definitions/lenientTokenList"
        }
      }
    },
    "vecMergeMode": {
      "enum": [
        "append",
        "prepend",
        "replace"
      ]
    },
    "mapMergeMode": {
      "enum": [
        "upsert",
        "replace",
        "remove"
      ]
    },
    "retryPolicyDefault": {
      "type": "object",
      "description": "Retry policy default body for a policy key under retryPolicyDefaults.",
      "properties": {
        "priority": {
          "type": "integer",
          "minimum": 0,
          "description": "Selection priority - higher values are evaluated first"
        },
        "predicate": {
          "$ref": "#/definitions/retryPredicate",
          "description": "Predicate tree defining when this policy applies"
        },
        "policy": {
          "$ref": "#/definitions/retryPolicy",
          "description": "Retry policy tree defining the retry strategy"
        }
      },
      "required": [
        "priority",
        "predicate",
        "policy"
      ],
      "additionalProperties": false
    },
    "predicateValue": {
      "description": "Predicate value encoded as primitive JSON value.",
      "oneOf": [
        {
          "type": "string"
        },
        {
          "type": "integer"
        },
        {
          "type": "boolean"
        }
      ]
    },
    "propertyComparison": {
      "type": "object",
      "description": "A property name and a value to compare against",
      "properties": {
        "property": {
          "type": "string"
        },
        "value": {
          "$ref": "#/definitions/predicateValue"
        }
      },
      "required": [
        "property",
        "value"
      ],
      "additionalProperties": false
    },
    "propertySetCheck": {
      "type": "object",
      "description": "A property name and a set of values to check membership",
      "properties": {
        "property": {
          "type": "string"
        },
        "values": {
          "type": "array",
          "items": {
            "$ref": "#/definitions/predicateValue"
          }
        }
      },
      "required": [
        "property",
        "values"
      ],
      "additionalProperties": false
    },
    "retryPredicate": {
      "description": "Composable retry predicate encoded as compact unions.",
      "oneOf": [
        {
          "type": "boolean"
        },
        {
          "type": "string",
          "enum": [
            "true",
            "false"
          ]
        },
        {
          "type": "object",
          "properties": {
            "propEq": {
              "$ref": "#/definitions/propertyComparison"
            }
          },
          "required": [
            "propEq"
          ],
          "additionalProperties": false
        },
        {
          "type": "object",
          "properties": {
            "propNeq": {
              "$ref": "#/definitions/propertyComparison"
            }
          },
          "required": [
            "propNeq"
          ],
          "additionalProperties": false
        },
        {
          "type": "object",
          "properties": {
            "propGt": {
              "$ref": "#/definitions/propertyComparison"
            }
          },
          "required": [
            "propGt"
          ],
          "additionalProperties": false
        },
        {
          "type": "object",
          "properties": {
            "propGte": {
              "$ref": "#/definitions/propertyComparison"
            }
          },
          "required": [
            "propGte"
          ],
          "additionalProperties": false
        },
        {
          "type": "object",
          "properties": {
            "propLt": {
              "$ref": "#/definitions/propertyComparison"
            }
          },
          "required": [
            "propLt"
          ],
          "additionalProperties": false
        },
        {
          "type": "object",
          "properties": {
            "propLte": {
              "$ref": "#/definitions/propertyComparison"
            }
          },
          "required": [
            "propLte"
          ],
          "additionalProperties": false
        },
        {
          "type": "object",
          "properties": {
            "propExists": {
              "oneOf": [
                {
                  "type": "string"
                },
                {
                  "type": "object",
                  "properties": {
                    "property": {
                      "type": "string"
                    }
                  },
                  "required": [
                    "property"
                  ],
                  "additionalProperties": false
                }
              ]
            }
          },
          "required": [
            "propExists"
          ],
          "additionalProperties": false
        },
        {
          "type": "object",
          "properties": {
            "propIn": {
              "$ref": "#/definitions/propertySetCheck"
            }
          },
          "required": [
            "propIn"
          ],
          "additionalProperties": false
        },
        {
          "type": "object",
          "properties": {
            "propMatches": {
              "type": "object",
              "properties": {
                "property": {
                  "type": "string"
                },
                "pattern": {
                  "type": "string"
                }
              },
              "required": [
                "property",
                "pattern"
              ],
              "additionalProperties": false
            }
          },
          "required": [
            "propMatches"
          ],
          "additionalProperties": false
        },
        {
          "type": "object",
          "properties": {
            "propStartsWith": {
              "type": "object",
              "properties": {
                "property": {
                  "type": "string"
                },
                "prefix": {
                  "type": "string"
                }
              },
              "required": [
                "property",
                "prefix"
              ],
              "additionalProperties": false
            }
          },
          "required": [
            "propStartsWith"
          ],
          "additionalProperties": false
        },
        {
          "type": "object",
          "properties": {
            "propContains": {
              "type": "object",
              "properties": {
                "property": {
                  "type": "string"
                },
                "substring": {
                  "type": "string"
                }
              },
              "required": [
                "property",
                "substring"
              ],
              "additionalProperties": false
            }
          },
          "required": [
            "propContains"
          ],
          "additionalProperties": false
        },
        {
          "type": "object",
          "properties": {
            "and": {
              "type": "array",
              "items": {
                "$ref": "#/definitions/retryPredicate"
              },
              "minItems": 2,
              "maxItems": 2
            }
          },
          "required": [
            "and"
          ],
          "additionalProperties": false
        },
        {
          "type": "object",
          "properties": {
            "or": {
              "type": "array",
              "items": {
                "$ref": "#/definitions/retryPredicate"
              },
              "minItems": 2,
              "maxItems": 2
            }
          },
          "required": [
            "or"
          ],
          "additionalProperties": false
        },
        {
          "type": "object",
          "properties": {
            "not": {
              "$ref": "#/definitions/retryPredicate"
            }
          },
          "required": [
            "not"
          ],
          "additionalProperties": false
        }
      ]
    },
    "duration": {
      "type": "object",
      "description": "A duration with seconds and nanoseconds",
      "properties": {
        "secs": {
          "type": "integer",
          "minimum": 0
        },
        "nanos": {
          "type": "integer",
          "minimum": 0,
          "maximum": 999999999
        }
      },
      "required": [
        "secs",
        "nanos"
      ],
      "additionalProperties": false
    },
    "retryPolicy": {
      "description": "Composable retry policy encoded as compact unions.",
      "oneOf": [
        {
          "type": "string",
          "enum": [
            "immediate",
            "never"
          ]
        },
        {
          "type": "object",
          "properties": {
            "periodic": {
              "$ref": "#/definitions/duration"
            }
          },
          "required": [
            "periodic"
          ],
          "additionalProperties": false
        },
        {
          "type": "object",
          "properties": {
            "exponential": {
              "type": "object",
              "properties": {
                "baseDelay": {
                  "$ref": "#/definitions/duration"
                },
                "factor": {
                  "type": "number"
                }
              },
              "required": [
                "baseDelay",
                "factor"
              ],
              "additionalProperties": false
            }
          },
          "required": [
            "exponential"
          ],
          "additionalProperties": false
        },
        {
          "type": "object",
          "properties": {
            "fibonacci": {
              "type": "object",
              "properties": {
                "first": {
                  "$ref": "#/definitions/duration"
                },
                "second": {
                  "$ref": "#/definitions/duration"
                }
              },
              "required": [
                "first",
                "second"
              ],
              "additionalProperties": false
            }
          },
          "required": [
            "fibonacci"
          ],
          "additionalProperties": false
        },
        {
          "type": "object",
          "properties": {
            "countBox": {
              "type": "object",
              "properties": {
                "maxRetries": {
                  "type": "integer",
                  "minimum": 0
                },
                "inner": {
                  "$ref": "#/definitions/retryPolicy"
                }
              },
              "required": [
                "maxRetries",
                "inner"
              ],
              "additionalProperties": false
            }
          },
          "required": [
            "countBox"
          ],
          "additionalProperties": false
        },
        {
          "type": "object",
          "properties": {
            "timeBox": {
              "type": "object",
              "properties": {
                "limit": {
                  "$ref": "#/definitions/duration"
                },
                "inner": {
                  "$ref": "#/definitions/retryPolicy"
                }
              },
              "required": [
                "limit",
                "inner"
              ],
              "additionalProperties": false
            }
          },
          "required": [
            "timeBox"
          ],
          "additionalProperties": false
        },
        {
          "type": "object",
          "properties": {
            "clamp": {
              "type": "object",
              "properties": {
                "minDelay": {
                  "$ref": "#/definitions/duration"
                },
                "maxDelay": {
                  "$ref": "#/definitions/duration"
                },
                "inner": {
                  "$ref": "#/definitions/retryPolicy"
                }
              },
              "required": [
                "minDelay",
                "maxDelay",
                "inner"
              ],
              "additionalProperties": false
            }
          },
          "required": [
            "clamp"
          ],
          "additionalProperties": false
        },
        {
          "type": "object",
          "properties": {
            "addDelay": {
              "type": "object",
              "properties": {
                "delay": {
                  "$ref": "#/definitions/duration"
                },
                "inner": {
                  "$ref": "#/definitions/retryPolicy"
                }
              },
              "required": [
                "delay",
                "inner"
              ],
              "additionalProperties": false
            }
          },
          "required": [
            "addDelay"
          ],
          "additionalProperties": false
        },
        {
          "type": "object",
          "properties": {
            "jitter": {
              "type": "object",
              "properties": {
                "factor": {
                  "type": "number"
                },
                "inner": {
                  "$ref": "#/definitions/retryPolicy"
                }
              },
              "required": [
                "factor",
                "inner"
              ],
              "additionalProperties": false
            }
          },
          "required": [
            "jitter"
          ],
          "additionalProperties": false
        },
        {
          "type": "object",
          "properties": {
            "filteredOn": {
              "type": "object",
              "properties": {
                "predicate": {
                  "$ref": "#/definitions/retryPredicate"
                },
                "inner": {
                  "$ref": "#/definitions/retryPolicy"
                }
              },
              "required": [
                "predicate",
                "inner"
              ],
              "additionalProperties": false
            }
          },
          "required": [
            "filteredOn"
          ],
          "additionalProperties": false
        },
        {
          "type": "object",
          "properties": {
            "andThen": {
              "type": "array",
              "items": {
                "$ref": "#/definitions/retryPolicy"
              },
              "minItems": 2,
              "maxItems": 2
            }
          },
          "required": [
            "andThen"
          ],
          "additionalProperties": false
        },
        {
          "type": "object",
          "properties": {
            "union": {
              "type": "array",
              "items": {
                "$ref": "#/definitions/retryPolicy"
              },
              "minItems": 2,
              "maxItems": 2
            }
          },
          "required": [
            "union"
          ],
          "additionalProperties": false
        },
        {
          "type": "object",
          "properties": {
            "intersect": {
              "type": "array",
              "items": {
                "$ref": "#/definitions/retryPolicy"
              },
              "minItems": 2,
              "maxItems": 2
            }
          },
          "required": [
            "intersect"
          ],
          "additionalProperties": false
        }
      ]
    },
    "resourceDefinitionCreation": {
      "type": "object",
      "description": "Quota resource definition body for a resource key under resourceDefaults.",
      "additionalProperties": false,
      "properties": {
        "limit": {
          "$ref": "#/definitions/resourceLimit"
        },
        "enforcementAction": {
          "$ref": "#/definitions/enforcementAction"
        },
        "unit": {
          "type": "string",
          "description": "Single unit of measurement (e.g., token, request)"
        },
        "units": {
          "type": "string",
          "description": "Multiple units of measurement (e.g., tokens, requests)"
        }
      },
      "required": [
        "limit",
        "enforcementAction",
        "unit",
        "units"
      ]
    },
    "resourceLimit": {
      "oneOf": [
        {
          "$ref": "#/definitions/resourceRateLimit"
        },
        {
          "$ref": "#/definitions/resourceCapacityLimit"
        },
        {
          "$ref": "#/definitions/resourceConcurrencyLimit"
        }
      ]
    },
    "resourceRateLimit": {
      "type": "object",
      "additionalProperties": false,
      "properties": {
        "type": {
          "enum": [
            "Rate"
          ]
        },
        "value": {
          "type": "integer",
          "minimum": 0
        },
        "period": {
          "$ref": "#/definitions/timePeriod"
        },
        "max": {
          "type": "integer",
          "minimum": 0
        }
      },
      "required": [
        "type",
        "value",
        "period",
        "max"
      ]
    },
    "resourceCapacityLimit": {
      "type": "object",
      "additionalProperties": false,
      "properties": {
        "type": {
          "enum": [
            "Capacity"
          ]
        },
        "value": {
          "type": "integer",
          "minimum": 0
        }
      },
      "required": [
        "type",
        "value"
      ]
    },
    "resourceConcurrencyLimit": {
      "type": "object",
      "additionalProperties": false,
      "properties": {
        "type": {
          "enum": [
            "Concurrency"
          ]
        },
        "value": {
          "type": "integer",
          "minimum": 0
        }
      },
      "required": [
        "type",
        "value"
      ]
    },
    "enforcementAction": {
      "type": "string",
      "enum": [
        "reject",
        "throttle",
        "terminate"
      ]
    },
    "timePeriod": {
      "type": "string",
      "enum": [
        "second",
        "minute",
        "hour",
        "day",
        "month",
        "year"
      ]
    },
    "registrySubject": {
      "description": "An exact immutable tool release reference by ID or by publisher account, tool root name, and version.",
      "oneOf": [
        {
          "type": "object",
          "additionalProperties": false,
          "required": [
            "releaseId"
          ],
          "properties": {
            "releaseId": {
              "type": "string",
              "format": "uuid"
            }
          }
        },
        {
          "type": "object",
          "additionalProperties": false,
          "required": [
            "account",
            "name",
            "version"
          ],
          "properties": {
            "account": {
              "type": "string"
            },
            "name": {
              "type": "string",
              "pattern": "^[a-z][a-z0-9]*(-[a-z0-9]+)*$"
            },
            "version": {
              "type": "string"
            }
          }
        }
      ]
    },
    "localSubject": {
      "type": "object",
      "additionalProperties": false,
      "required": [
        "component",
        "name"
      ],
      "properties": {
        "component": {
          "type": "string"
        },
        "name": {
          "type": "string"
        }
      }
    },
    "componentConfigSchema": {
      "type": "object",
      "additionalProperties": false,
      "properties": {
        "schema": { "type": "object" },
        "declarations": {
          "type": "array",
          "items": {
            "type": "object",
            "additionalProperties": false,
            "required": ["source", "path", "value_type"],
            "properties": {
              "source": { "enum": ["Local", "Secret"] },
              "path": { "type": "array", "items": { "type": "string" } },
              "value_type": { "type": "object" }
            }
          }
        }
      }
    },
    "componentDependencyReference": {
      "description": "A guest bridge dependency reference. Agents always use 'component/name' or { component, name }. Tools may use a bare logical name resolved through tools.<name>, or an explicit local reference in the same provider-qualified forms.",
      "oneOf": [
        {
          "type": "string"
        },
        {
          "$ref": "#/definitions/localSubject"
        }
      ]
    }
  }
}
