{
  "$schema": "http://json-schema.org/draft-07/schema#",
  "$id": "https://secrets.rin.ci/schema.json",
  "title": "rinci-secrets config",
  "description": "Where @rinci/secrets reads secrets from. Credentials never go in this file: they come from the environment or envFiles.",
  "type": "object",
  "additionalProperties": false,
  "required": [
    "sources"
  ],
  "properties": {
    "$schema": {
      "type": "string"
    },
    "envFiles": {
      "description": "Files holding provider credentials, e.g. .env.infisical. Missing files are skipped. Never passed to the child process.",
      "type": "array",
      "items": {
        "type": "string"
      }
    },
    "sources": {
      "description": "Read in parallel and merged in order: on a duplicate key the later source wins.",
      "type": "array",
      "minItems": 1,
      "items": {
        "$ref": "#/definitions/source"
      }
    },
    "override": {
      "description": "Replace variables already set in the environment. Default true.",
      "type": "boolean"
    },
    "pure": {
      "description": "Start the child from a minimal environment (PATH, HOME, locale, temp dirs) plus the secrets. Default false.",
      "type": "boolean"
    },
    "keepCredentials": {
      "description": "Pass provider credentials (e.g. INFISICAL_CLIENT_SECRET) through to the child. Default false.",
      "type": "boolean"
    }
  },
  "definitions": {
    "common": {
      "type": "object",
      "properties": {
        "name": {
          "type": "string",
          "description": "Label for --source and logs. Defaults to the provider name."
        },
        "optional": {
          "type": "boolean",
          "description": "Log and skip on failure instead of stopping the run."
        },
        "withhold": {
          "type": "array",
          "items": {
            "type": "string"
          },
          "description": "Extra credential variables this source logs in with. Removed from the child like the built-in ones."
        },
        "timeoutMs": {
          "type": "number",
          "description": "Per-request timeout. Default 15000."
        },
        "allowInsecure": {
          "type": "boolean",
          "description": "Allow plain HTTP to a public host. Private addresses are always allowed."
        }
      }
    },
    "names": {
      "description": "A list of names, or an object of ENV_NAME: remote-name.",
      "oneOf": [
        {
          "type": "array",
          "items": {
            "type": "string"
          }
        },
        {
          "type": "object",
          "additionalProperties": {
            "type": "string"
          }
        }
      ]
    },
    "format": {
      "enum": [
        "auto",
        "json",
        "dotenv",
        "raw"
      ],
      "description": "How to read one stored value: auto (JSON object, else raw under key), json, dotenv or raw."
    },
    "source": {
      "type": "object",
      "required": [
        "provider"
      ],
      "allOf": [
        {
          "$ref": "#/definitions/common"
        },
        {
          "if": {
            "properties": {
              "provider": {
                "const": "infisical"
              }
            }
          },
          "then": {
            "required": [
              "environment"
            ],
            "properties": {
              "domain": {
                "type": "string",
                "description": "Default https://app.infisical.com or INFISICAL_DOMAIN."
              },
              "projectId": {
                "type": "string",
                "description": "Or INFISICAL_PROJECT_ID."
              },
              "environment": {
                "type": "string",
                "description": "Environment slug, e.g. ${SECRETS_ENV:-dev}."
              },
              "path": {
                "type": "string",
                "description": "Folder path. Default /."
              },
              "recursive": {
                "type": "boolean"
              }
            }
          }
        },
        {
          "if": {
            "properties": {
              "provider": {
                "const": "doppler"
              }
            }
          },
          "then": {
            "properties": {
              "project": {
                "type": "string"
              },
              "config": {
                "type": "string"
              },
              "apiHost": {
                "type": "string"
              }
            }
          }
        },
        {
          "if": {
            "properties": {
              "provider": {
                "enum": [
                  "vault",
                  "openbao",
                  "hashicorp"
                ]
              }
            }
          },
          "then": {
            "required": [
              "path"
            ],
            "properties": {
              "address": {
                "type": "string",
                "description": "Or VAULT_ADDR."
              },
              "mount": {
                "type": "string",
                "description": "Default secret."
              },
              "path": {
                "type": "string"
              },
              "kvVersion": {
                "enum": [
                  1,
                  2
                ]
              },
              "namespace": {
                "type": "string",
                "description": "Or VAULT_NAMESPACE."
              },
              "approleMount": {
                "type": "string",
                "description": "Default approle."
              }
            }
          }
        },
        {
          "if": {
            "properties": {
              "provider": {
                "enum": [
                  "aws",
                  "aws-secrets-manager"
                ]
              }
            }
          },
          "then": {
            "required": [
              "secretId"
            ],
            "properties": {
              "region": {
                "type": "string",
                "description": "Or AWS_REGION."
              },
              "secretId": {
                "type": "string"
              },
              "versionStage": {
                "type": "string"
              },
              "endpoint": {
                "type": "string"
              },
              "format": {
                "$ref": "#/definitions/format"
              },
              "key": {
                "type": "string"
              }
            }
          }
        },
        {
          "if": {
            "properties": {
              "provider": {
                "enum": [
                  "aws-ssm",
                  "ssm",
                  "parameter-store"
                ]
              }
            }
          },
          "then": {
            "properties": {
              "region": {
                "type": "string",
                "description": "Or AWS_REGION."
              },
              "path": {
                "type": "string",
                "description": "Read every parameter below this path, e.g. /myapp/prod."
              },
              "recursive": {
                "type": "boolean",
                "description": "Include nested paths. Default true."
              },
              "parameters": {
                "$ref": "#/definitions/names"
              },
              "endpoint": {
                "type": "string"
              }
            }
          }
        },
        {
          "if": {
            "properties": {
              "provider": {
                "enum": [
                  "gcp",
                  "gcp-secret-manager"
                ]
              }
            }
          },
          "then": {
            "properties": {
              "project": {
                "type": "string",
                "description": "Or GOOGLE_CLOUD_PROJECT."
              },
              "secret": {
                "type": "string",
                "description": "One secret holding many vars. name or name@version."
              },
              "secrets": {
                "$ref": "#/definitions/names"
              },
              "format": {
                "$ref": "#/definitions/format"
              },
              "key": {
                "type": "string"
              }
            }
          }
        },
        {
          "if": {
            "properties": {
              "provider": {
                "enum": [
                  "azure",
                  "azure-key-vault"
                ]
              }
            }
          },
          "then": {
            "required": [
              "vault"
            ],
            "properties": {
              "vault": {
                "type": "string",
                "description": "Vault name or https URL."
              },
              "secrets": {
                "$ref": "#/definitions/names"
              },
              "authorityHost": {
                "type": "string"
              }
            }
          }
        },
        {
          "if": {
            "properties": {
              "provider": {
                "enum": [
                  "1password",
                  "onepassword",
                  "op"
                ]
              }
            }
          },
          "then": {
            "required": [
              "item"
            ],
            "properties": {
              "item": {
                "type": "string"
              },
              "vault": {
                "type": "string"
              },
              "account": {
                "type": "string"
              },
              "fields": {
                "$ref": "#/definitions/names"
              },
              "cli": {
                "type": "string"
              }
            }
          }
        },
        {
          "if": {
            "properties": {
              "provider": {
                "enum": [
                  "bitwarden",
                  "bws"
                ]
              }
            }
          },
          "then": {
            "properties": {
              "projectId": {
                "type": "string"
              },
              "serverUrl": {
                "type": "string"
              },
              "cli": {
                "type": "string"
              }
            }
          }
        },
        {
          "if": {
            "properties": {
              "provider": {
                "const": "sops"
              }
            }
          },
          "then": {
            "required": [
              "file"
            ],
            "properties": {
              "file": {
                "type": "string",
                "description": "Encrypted .env, JSON, YAML or INI file, relative to the config."
              },
              "inputType": {
                "enum": [
                  "dotenv",
                  "json",
                  "yaml",
                  "ini",
                  "binary"
                ]
              },
              "cli": {
                "type": "string"
              }
            }
          }
        },
        {
          "if": {
            "properties": {
              "provider": {
                "enum": [
                  "exec",
                  "command"
                ]
              }
            }
          },
          "then": {
            "required": [
              "command"
            ],
            "properties": {
              "command": {
                "type": "string",
                "description": "Program to run, without a shell."
              },
              "args": {
                "type": "array",
                "items": {
                  "type": "string"
                }
              },
              "format": {
                "$ref": "#/definitions/format"
              },
              "key": {
                "type": "string",
                "description": "Store the whole output under this name (format raw)."
              }
            }
          }
        },
        {
          "if": {
            "properties": {
              "provider": {
                "enum": [
                  "dotenv",
                  "env"
                ]
              }
            }
          },
          "then": {
            "properties": {
              "path": {
                "oneOf": [
                  {
                    "type": "string"
                  },
                  {
                    "type": "array",
                    "items": {
                      "type": "string"
                    }
                  }
                ]
              },
              "required": {
                "type": "boolean"
              }
            }
          }
        }
      ],
      "properties": {
        "provider": {
          "type": "string",
          "enum": [
            "infisical",
            "doppler",
            "vault",
            "openbao",
            "hashicorp",
            "aws",
            "aws-secrets-manager",
            "aws-ssm",
            "ssm",
            "parameter-store",
            "gcp",
            "gcp-secret-manager",
            "azure",
            "azure-key-vault",
            "1password",
            "onepassword",
            "op",
            "bitwarden",
            "bws",
            "sops",
            "dotenv",
            "env",
            "exec",
            "command"
          ]
        }
      }
    }
  }
}