{
  "$schema": "https://json-schema.org/draft/2020-12/schema",
  "title": "MmConfig",
  "type": "object",
  "properties": {
    "agents": {
      "description": "What an AI agent may do through `mm mcp serve`, per environment.",
      "type": "object",
      "additionalProperties": {
        "$ref": "#/$defs/AgentAccessConfig"
      }
    },
    "bindings": {
      "type": "object",
      "additionalProperties": {
        "$ref": "#/$defs/EnvironmentBinding"
      },
      "default": {}
    },
    "build": {
      "$ref": "#/$defs/BuildConfig"
    },
    "default-environment": {
      "type": [
        "string",
        "null"
      ]
    },
    "development-mail": {
      "$ref": "#/$defs/DevelopmentMailPolicy"
    },
    "development-mounts": {
      "$ref": "#/$defs/DevelopmentMountPolicy"
    },
    "environment-delivery": {
      "$ref": "#/$defs/EnvironmentDeliveryPolicy"
    },
    "environments": {
      "type": "object",
      "additionalProperties": {
        "$ref": "#/$defs/EnvironmentConfig"
      }
    },
    "gates": {
      "type": "object",
      "additionalProperties": {
        "$ref": "#/$defs/GateConfig"
      }
    },
    "ingress": {
      "$ref": "#/$defs/ProjectIngressConfig"
    },
    "jobs": {
      "type": "object",
      "additionalProperties": {
        "$ref": "#/$defs/JobConfig"
      }
    },
    "modules": {
      "type": "object",
      "additionalProperties": {
        "$ref": "#/$defs/ModuleConfig"
      },
      "default": {}
    },
    "networks": {
      "type": "object",
      "additionalProperties": {
        "$ref": "#/$defs/NetworkConfig"
      }
    },
    "project": {
      "$ref": "#/$defs/ProjectConfig"
    },
    "providers": {
      "type": "object",
      "additionalProperties": {
        "$ref": "#/$defs/ProviderInstanceConfig"
      }
    },
    "registries": {
      "description": "Image registries and the credentials deploys pull with, by host.",
      "type": "object",
      "additionalProperties": {
        "$ref": "#/$defs/RegistryConfig"
      }
    },
    "runtime": {
      "$ref": "#/$defs/RuntimeConfig",
      "default": {}
    },
    "schedules": {
      "type": "object",
      "additionalProperties": {
        "$ref": "#/$defs/ScheduleConfig"
      }
    },
    "schema-version": {
      "type": "integer",
      "format": "uint32",
      "maximum": 1,
      "minimum": 1
    },
    "secrets": {
      "type": "object",
      "additionalProperties": {
        "$ref": "#/$defs/SecretDeclaration"
      },
      "default": {}
    },
    "stacks": {
      "type": "object",
      "additionalProperties": {
        "$ref": "#/$defs/StackConfig"
      }
    },
    "target": {
      "type": "string"
    },
    "targets": {
      "description": "Public connection facts for remote targets; clients pin them.",
      "type": "object",
      "additionalProperties": {
        "$ref": "#/$defs/RepoTargetConfig"
      }
    },
    "users": {
      "description": "Who may reach each remote environment, reconciled on deploy.",
      "type": "object",
      "additionalProperties": {
        "$ref": "#/$defs/UserConfig"
      }
    }
  },
  "$comment": "Generated from MmConfig; run ./scripts/generate-artifacts.sh. Do not edit.",
  "additionalProperties": false,
  "required": [
    "schema-version",
    "project",
    "target",
    "stacks",
    "environments"
  ],
  "$defs": {
    "AccessLevel": {
      "description": "Access levels a repo grants per environment. Each includes the previous.",
      "oneOf": [
        {
          "description": "Plan, status, inspect, logs, and the Swarm node list.",
          "type": "string",
          "const": "view"
        },
        {
          "description": "`view` plus restart and job run, cancel, and retry.",
          "type": "string",
          "const": "operate"
        },
        {
          "description": "`operate` plus deploy, rollback, and team sync.",
          "type": "string",
          "const": "deploy"
        },
        {
          "description": "`deploy` plus exec, forward, secrets, emergency blocks, audit, and\nSwarm placement groups, storage, and ingress nodes.",
          "type": "string",
          "const": "admin"
        }
      ]
    },
    "AgentAccess": {
      "description": "What an agent may do in one environment.",
      "type": "object",
      "properties": {
        "exec": {
          "description": "Services the agent may run commands in: `true`, or a list of names.",
          "$ref": "#/$defs/ServiceSelection"
        },
        "level": {
          "description": "`view`, `operate`, or `deploy`. Agents are never `admin`.",
          "$ref": "#/$defs/AccessLevel"
        }
      },
      "additionalProperties": false,
      "required": [
        "level"
      ]
    },
    "AgentAccessConfig": {
      "description": "`production: view` or `local: { level: deploy, exec: true }`.",
      "anyOf": [
        {
          "$ref": "#/$defs/AccessLevel"
        },
        {
          "$ref": "#/$defs/AgentAccess"
        }
      ]
    },
    "BuildConfig": {
      "type": "object",
      "properties": {
        "platforms": {
          "type": "array",
          "default": [
            "linux/amd64",
            "linux/arm64"
          ],
          "items": {
            "type": "string"
          }
        },
        "tag-strategy": {
          "$ref": "#/$defs/BuildTagStrategy",
          "default": "auto"
        }
      },
      "additionalProperties": false
    },
    "BuildTagStrategy": {
      "type": "string",
      "enum": [
        "auto",
        "immutable"
      ]
    },
    "CastBinding": {
      "type": "object",
      "properties": {
        "cast": {
          "$ref": "#/$defs/ValueCast"
        },
        "value-ref": {
          "type": "string"
        }
      },
      "additionalProperties": false,
      "required": [
        "cast",
        "value-ref"
      ]
    },
    "DevelopmentBindMount": {
      "type": "object",
      "properties": {
        "source": {
          "description": "Relative to the module path, like the primary source.",
          "type": "string"
        },
        "target": {
          "type": "string"
        }
      },
      "additionalProperties": false,
      "required": [
        "source",
        "target"
      ]
    },
    "DevelopmentMailPolicy": {
      "type": "object",
      "properties": {
        "bindings": {
          "type": "object",
          "additionalProperties": {
            "$ref": "#/$defs/DevelopmentMailValue"
          }
        },
        "enabled": {
          "type": [
            "boolean",
            "null"
          ]
        }
      },
      "additionalProperties": false
    },
    "DevelopmentMailValue": {
      "type": "string",
      "enum": [
        "smtp-host",
        "smtp-port",
        "smtp-url",
        "ui-url"
      ]
    },
    "DevelopmentMountConfig": {
      "type": "object",
      "properties": {
        "additional": {
          "description": "Additional source directories mounted into the same services with the same mode.",
          "type": "array",
          "items": {
            "$ref": "#/$defs/DevelopmentBindMount"
          }
        },
        "excludes": {
          "type": "array",
          "items": {
            "type": "string"
          }
        },
        "mode": {
          "$ref": "#/$defs/DevelopmentMountMode",
          "default": "read-write"
        },
        "preserve": {
          "type": "array",
          "items": {
            "$ref": "#/$defs/PreservedContainerPath"
          }
        },
        "preset": {
          "anyOf": [
            {
              "$ref": "#/$defs/DevelopmentMountPreset"
            },
            {
              "type": "null"
            }
          ]
        },
        "protected": {
          "type": "array",
          "items": {
            "type": "string"
          }
        },
        "safe-exceptions": {
          "type": "array",
          "items": {
            "type": "string"
          }
        },
        "services": {
          "type": "array",
          "items": {
            "type": "string"
          }
        },
        "source": {
          "description": "Relative to the module path, never the workstation root.",
          "type": "string"
        },
        "target": {
          "description": "Absolute POSIX path in the selected container services.",
          "type": "string"
        }
      },
      "additionalProperties": false,
      "required": [
        "source",
        "target",
        "services"
      ]
    },
    "DevelopmentMountMode": {
      "type": "string",
      "enum": [
        "read-write",
        "read-only"
      ]
    },
    "DevelopmentMountPolicy": {
      "type": "object",
      "properties": {
        "sensitive-patterns": {
          "description": "Additional case-insensitive glob-like names (`*` matches any substring).",
          "type": "array",
          "items": {
            "type": "string"
          }
        }
      },
      "additionalProperties": false
    },
    "DevelopmentMountPreset": {
      "type": "string",
      "enum": [
        "laravel",
        "node",
        "dotnet",
        "rust"
      ]
    },
    "EnvScalar": {
      "anyOf": [
        {
          "type": "string"
        },
        {
          "type": "integer",
          "format": "int64"
        },
        {
          "type": "boolean"
        }
      ]
    },
    "EnvironmentAccess": {
      "description": "One user's effective access in one environment.",
      "type": "object",
      "properties": {
        "exec": {
          "$ref": "#/$defs/ServiceSelection"
        },
        "forward": {
          "$ref": "#/$defs/ServiceSelection"
        },
        "level": {
          "$ref": "#/$defs/AccessLevel"
        },
        "secrets": {
          "type": "boolean"
        }
      },
      "additionalProperties": false,
      "required": [
        "level"
      ]
    },
    "EnvironmentBinding": {
      "anyOf": [
        {
          "$ref": "#/$defs/CastBinding"
        },
        {
          "$ref": "#/$defs/SecretBinding"
        },
        {
          "$ref": "#/$defs/ValueBinding"
        }
      ]
    },
    "EnvironmentConfig": {
      "type": "object",
      "properties": {
        "automatic-local-ingress": {
          "type": [
            "boolean",
            "null"
          ]
        },
        "bindings": {
          "type": "object",
          "additionalProperties": {
            "$ref": "#/$defs/EnvironmentBinding"
          },
          "default": {}
        },
        "build-variant": {
          "type": [
            "string",
            "null"
          ]
        },
        "deploy-from": {
          "description": "Branches a commit must be reachable from to be deployed here: names, or\npatterns where `*` matches within one `/` segment (`*.x`); `*` alone is\nany branch. A commit that changes this list must pass the current one.",
          "type": [
            "array",
            "null"
          ],
          "items": {
            "type": "string"
          }
        },
        "domains": {
          "type": "object",
          "additionalProperties": {
            "type": "string"
          },
          "default": {}
        },
        "environment-delivery": {
          "anyOf": [
            {
              "$ref": "#/$defs/EnvironmentDeliveryMode"
            },
            {
              "type": "null"
            }
          ]
        },
        "runtime": {
          "anyOf": [
            {
              "$ref": "#/$defs/RuntimeConfig"
            },
            {
              "type": "null"
            }
          ]
        },
        "target": {
          "type": [
            "string",
            "null"
          ]
        },
        "tls": {
          "description": "Serve this certificate for the environment's domains instead of\nrequesting them from ACME. Swarm ingress only.",
          "anyOf": [
            {
              "$ref": "#/$defs/EnvironmentTlsConfig"
            },
            {
              "type": "null"
            }
          ]
        }
      },
      "additionalProperties": false
    },
    "EnvironmentDeliveryMode": {
      "type": "string",
      "enum": [
        "direct",
        "env-file"
      ]
    },
    "EnvironmentDeliveryPolicy": {
      "type": "object",
      "properties": {
        "default": {
          "anyOf": [
            {
              "$ref": "#/$defs/EnvironmentDeliveryMode"
            },
            {
              "type": "null"
            }
          ]
        },
        "development-default": {
          "anyOf": [
            {
              "$ref": "#/$defs/EnvironmentDeliveryMode"
            },
            {
              "type": "null"
            }
          ]
        }
      },
      "additionalProperties": false
    },
    "EnvironmentTlsConfig": {
      "description": "A certificate the operator provides for an environment's domains, such as\na Cloudflare origin certificate behind Cloudflare Access, where ACME\nchallenges cannot reach the origin. Both secrets hold a PEM file encoded\nas base64 on one line (`base64 -w0 cert.pem | mm secret set NAME --stdin`).",
      "type": "object",
      "properties": {
        "certificate": {
          "description": "Secret holding the certificate chain.",
          "type": "string"
        },
        "key": {
          "description": "Secret holding the private key.",
          "type": "string"
        }
      },
      "additionalProperties": false,
      "required": [
        "certificate",
        "key"
      ]
    },
    "GateConfig": {
      "type": "object",
      "properties": {
        "ingress": {
          "type": "array",
          "items": {
            "type": "string"
          }
        },
        "provider": {
          "type": "string"
        }
      },
      "additionalProperties": false,
      "required": [
        "provider"
      ]
    },
    "IngressConfig": {
      "anyOf": [
        {
          "$ref": "#/$defs/IngressRouteConfig"
        },
        {
          "type": "array",
          "items": {
            "$ref": "#/$defs/IngressRouteConfig"
          }
        }
      ]
    },
    "IngressRouteConfig": {
      "type": "object",
      "properties": {
        "domain": {
          "type": "string"
        },
        "environments": {
          "type": "array",
          "items": {
            "type": "string"
          }
        },
        "https": {
          "type": "boolean",
          "default": true
        },
        "port": {
          "type": [
            "integer",
            "null"
          ],
          "format": "uint16",
          "maximum": 65535,
          "minimum": 0
        },
        "route": {
          "type": "string",
          "default": "/"
        },
        "service": {
          "type": [
            "string",
            "null"
          ]
        }
      },
      "additionalProperties": false,
      "required": [
        "domain"
      ]
    },
    "Ipv4Cidr": {
      "description": "An IPv4 network in CIDR notation, such as 10.77.0.0/24.",
      "type": "string",
      "pattern": "^\\d{1,3}(\\.\\d{1,3}){3}/\\d{1,2}$"
    },
    "JobConfig": {
      "type": "object",
      "properties": {
        "command": {
          "type": "array",
          "items": {
            "type": "string"
          }
        },
        "environment": {
          "type": [
            "string",
            "null"
          ]
        },
        "history-limit": {
          "type": "integer",
          "format": "uint32",
          "default": 100,
          "minimum": 0
        },
        "module": {
          "type": "string"
        },
        "output-limit-bytes": {
          "type": "integer",
          "format": "uint32",
          "default": 65536,
          "minimum": 0
        },
        "retry": {
          "$ref": "#/$defs/RetryPolicyConfig",
          "default": {
            "attempts": 1,
            "backoff": "5s",
            "max-backoff": "5m"
          }
        },
        "service": {
          "type": "string"
        },
        "timeout": {
          "type": "string",
          "default": "10m"
        }
      },
      "additionalProperties": false,
      "required": [
        "module",
        "service",
        "command"
      ]
    },
    "MiddlewareBundleConfig": {
      "type": "object",
      "properties": {
        "environments": {
          "type": "array",
          "items": {
            "type": "string"
          }
        },
        "file": {
          "type": "string"
        }
      },
      "additionalProperties": false,
      "required": [
        "file"
      ]
    },
    "MisfirePolicy": {
      "oneOf": [
        {
          "type": "string",
          "enum": [
            "skip",
            "run-once"
          ]
        },
        {
          "type": "object",
          "properties": {
            "bounded-catch-up": {
              "type": "object",
              "properties": {
                "maximum": {
                  "type": "integer",
                  "format": "uint16",
                  "maximum": 65535,
                  "minimum": 0
                }
              },
              "required": [
                "maximum"
              ]
            }
          },
          "additionalProperties": false,
          "required": [
            "bounded-catch-up"
          ]
        }
      ]
    },
    "ModuleBuildConfig": {
      "type": "object",
      "properties": {
        "args": {
          "type": "object",
          "additionalProperties": {
            "$ref": "#/$defs/EnvScalar"
          },
          "default": {}
        },
        "context": {
          "type": [
            "string",
            "null"
          ]
        },
        "credential-only-secrets": {
          "description": "Keys of `secrets` that only authenticate fetching inputs, such as a\npackage registry token. They are still mounted, but they do not change\nthe image, so they never block reuse or promotion of a build.",
          "type": "array",
          "items": {
            "type": "string"
          }
        },
        "default-variant": {
          "type": [
            "string",
            "null"
          ]
        },
        "depends-on": {
          "type": "object",
          "additionalProperties": {
            "type": "string"
          }
        },
        "dockerfile": {
          "type": [
            "string",
            "null"
          ]
        },
        "enabled": {
          "type": "boolean",
          "default": true
        },
        "extra-inputs": {
          "type": "array",
          "items": {
            "type": "string"
          }
        },
        "image": {
          "type": [
            "string",
            "null"
          ]
        },
        "secrets": {
          "type": "object",
          "additionalProperties": {
            "type": "string"
          },
          "default": {}
        },
        "targets": {
          "type": "object",
          "additionalProperties": {
            "type": "string"
          },
          "default": {}
        }
      },
      "additionalProperties": false
    },
    "ModuleConfig": {
      "type": "object",
      "properties": {
        "build": {
          "anyOf": [
            {
              "$ref": "#/$defs/ModuleBuildConfig"
            },
            {
              "type": "null"
            }
          ]
        },
        "development-mail": {
          "type": [
            "boolean",
            "null"
          ]
        },
        "development-mount": {
          "anyOf": [
            {
              "$ref": "#/$defs/DevelopmentMountConfig"
            },
            {
              "type": "null"
            }
          ]
        },
        "env": {
          "anyOf": [
            {
              "$ref": "#/$defs/ModuleEnvConfig"
            },
            {
              "type": "null"
            }
          ]
        },
        "networks": {
          "type": "array",
          "items": {
            "type": "string"
          }
        },
        "path": {
          "type": "string"
        },
        "services": {
          "type": "object",
          "additionalProperties": {
            "$ref": "#/$defs/ServiceConfig"
          },
          "default": {}
        }
      },
      "additionalProperties": false,
      "required": [
        "path"
      ]
    },
    "ModuleEnvConfig": {
      "type": "object",
      "properties": {
        "template": {
          "type": "string"
        }
      },
      "additionalProperties": false,
      "required": [
        "template"
      ]
    },
    "NetworkConfig": {
      "type": "object",
      "additionalProperties": false
    },
    "PlacementSpec": {
      "description": "One placement word, or a list whose entries must all hold.",
      "anyOf": [
        {
          "type": "string"
        },
        {
          "type": "array",
          "items": {
            "type": "string"
          }
        }
      ]
    },
    "PreservedContainerPath": {
      "type": "object",
      "properties": {
        "path": {
          "type": "string"
        }
      },
      "additionalProperties": false,
      "required": [
        "path"
      ]
    },
    "PrivateNetworkFields": {
      "description": "The YAML shape of [`PrivateNetworkConfig`].",
      "type": "object",
      "properties": {
        "interface": {
          "description": "An existing private interface, such as a provider's VLAN NIC (`eth1`).",
          "type": [
            "string",
            "null"
          ]
        },
        "wireguard": {
          "description": "A WireGuard mesh setup creates between every pair of nodes.",
          "anyOf": [
            {
              "$ref": "#/$defs/WireguardNetwork"
            },
            {
              "type": "null"
            }
          ]
        }
      },
      "additionalProperties": false
    },
    "ProjectConfig": {
      "type": "object",
      "properties": {
        "development-environment": {
          "type": [
            "string",
            "null"
          ]
        },
        "id": {
          "type": "string",
          "format": "uuid"
        },
        "name": {
          "type": "string"
        }
      },
      "additionalProperties": false,
      "required": [
        "id",
        "name"
      ]
    },
    "ProjectIngressConfig": {
      "type": "object",
      "properties": {
        "automatic-local": {
          "type": [
            "boolean",
            "null"
          ]
        },
        "middlewares": {
          "type": "object",
          "additionalProperties": {
            "$ref": "#/$defs/MiddlewareBundleConfig"
          }
        }
      },
      "additionalProperties": false
    },
    "ProviderDriverId": {
      "type": "string"
    },
    "ProviderInstanceConfig": {
      "type": "object",
      "properties": {
        "driver": {
          "$ref": "#/$defs/ProviderDriverId"
        },
        "scope": {
          "$ref": "#/$defs/ProviderScope"
        }
      },
      "oneOf": [
        {
          "type": "object",
          "properties": {
            "installation": {
              "type": "string"
            },
            "management-port": {
              "type": "integer",
              "format": "uint16",
              "maximum": 65535,
              "minimum": 0
            },
            "mode": {
              "type": "string",
              "const": "managed"
            },
            "release": {
              "type": "string"
            }
          },
          "required": [
            "mode",
            "installation",
            "release",
            "management-port"
          ]
        },
        {
          "type": "object",
          "properties": {
            "address": {
              "type": "string"
            },
            "automation-auth-mount": {
              "type": "string"
            },
            "expected-trust-sha256": {
              "type": "string"
            },
            "mode": {
              "type": "string",
              "const": "external"
            },
            "namespace": {
              "type": [
                "string",
                "null"
              ]
            },
            "storage-mount": {
              "type": "string"
            },
            "trust-bundle": {
              "type": "string"
            }
          },
          "required": [
            "mode",
            "address",
            "storage-mount",
            "automation-auth-mount",
            "trust-bundle",
            "expected-trust-sha256"
          ]
        }
      ],
      "required": [
        "driver",
        "scope"
      ]
    },
    "ProviderScope": {
      "type": "string",
      "enum": [
        "installation",
        "project"
      ]
    },
    "RegistryConfig": {
      "description": "A registry, keyed by its host (`ghcr.io`, `registry.example.com:5000`).",
      "type": "object",
      "properties": {
        "password": {
          "description": "The secret holding the password or access token; set it per environment.",
          "$ref": "#/$defs/RegistryPassword"
        },
        "username": {
          "description": "The account the token belongs to. GHCR accepts any name with a token.",
          "type": "string"
        }
      },
      "additionalProperties": false,
      "required": [
        "username",
        "password"
      ]
    },
    "RegistryPassword": {
      "type": "object",
      "properties": {
        "secret": {
          "type": "string"
        }
      },
      "additionalProperties": false,
      "required": [
        "secret"
      ]
    },
    "RepoBreakGlassKey": {
      "type": "object",
      "properties": {
        "key": {
          "description": "`ssh-ed25519 AAAA… comment`; keep the private half offline.",
          "type": "string"
        },
        "name": {
          "type": "string"
        }
      },
      "additionalProperties": false,
      "required": [
        "name",
        "key"
      ]
    },
    "RepoDeployKey": {
      "type": "object",
      "properties": {
        "public-key": {
          "description": "Its public half, as added to the git host.",
          "type": "string"
        },
        "secret": {
          "description": "The age secret holding the private key (`mm target setup deploy-key`\ncreates it).",
          "type": "string"
        }
      },
      "additionalProperties": false,
      "required": [
        "secret",
        "public-key"
      ]
    },
    "RepoSwarmConfig": {
      "description": "How the nodes form one Swarm.",
      "type": "object",
      "properties": {
        "address-pool": {
          "description": "Overlay network addresses (`docker swarm init --default-addr-pool`).\nDocker uses 10.0.0.0/8 when this is unset.",
          "anyOf": [
            {
              "$ref": "#/$defs/Ipv4Cidr"
            },
            {
              "type": "null"
            }
          ]
        },
        "address-pool-mask": {
          "description": "Prefix length of each overlay network taken from the pool.",
          "type": [
            "integer",
            "null"
          ],
          "format": "uint8",
          "maximum": 255,
          "minimum": 0
        },
        "groups": {
          "description": "Placement groups and the nodes in each (`mm target swarm group`).",
          "type": "object",
          "additionalProperties": {
            "type": "array",
            "items": {
              "type": "string"
            }
          }
        },
        "ingress": {
          "description": "Nodes that publish HTTP ingress. Unset means every manager.",
          "type": [
            "array",
            "null"
          ],
          "items": {
            "type": "string"
          }
        },
        "private-network": {
          "$ref": "#/$defs/PrivateNetworkFields"
        },
        "storage": {
          "description": "The node that holds named volumes (`mm target swarm storage`).",
          "type": [
            "string",
            "null"
          ]
        }
      },
      "additionalProperties": false,
      "required": [
        "private-network"
      ]
    },
    "RepoTargetConfig": {
      "description": "A repo target takes one of two forms. The flat form names one host and its\nfailover `members`. The cluster form lists `nodes` instead; `mm target\nsetup` builds them into a Swarm and `mm target setup record` writes each\nnode's keys back.",
      "type": "object",
      "properties": {
        "daemon-fingerprint": {
          "description": "Printed by `mmd --print-identity` on the host.",
          "type": [
            "string",
            "null"
          ]
        },
        "host": {
          "description": "Flat form: the host mm connects to first.",
          "type": [
            "string",
            "null"
          ]
        },
        "host-key": {
          "description": "The host's SSH public key, `<type> <base64>`; its fingerprint is derived.",
          "type": [
            "string",
            "null"
          ]
        },
        "members": {
          "description": "Other Swarm managers running `mmd`, in failover order. mm tries the\ntarget's own host first, then each member, and moves on only when it\ncannot connect.",
          "type": "array",
          "items": {
            "$ref": "#/$defs/RepoTargetMember"
          }
        },
        "nodes": {
          "description": "Cluster form: every node, in failover order. Replaces `host`,\n`host-key`, `daemon-fingerprint`, and `members`.",
          "type": "array",
          "items": {
            "$ref": "#/$defs/RepoTargetNode"
          }
        },
        "port": {
          "type": "integer",
          "format": "uint16",
          "maximum": 65535,
          "minimum": 0
        },
        "setup": {
          "description": "Cluster form: what setup installs on every node.",
          "anyOf": [
            {
              "$ref": "#/$defs/RepoTargetSetup"
            },
            {
              "type": "null"
            }
          ]
        },
        "swarm": {
          "description": "Cluster form: how setup joins the nodes into one Swarm.",
          "anyOf": [
            {
              "$ref": "#/$defs/RepoSwarmConfig"
            },
            {
              "type": "null"
            }
          ]
        }
      },
      "additionalProperties": false
    },
    "RepoTargetMember": {
      "description": "A failover endpoint of a repo target: the same facts as the target's own\nhost.",
      "type": "object",
      "properties": {
        "daemon-fingerprint": {
          "description": "Printed by `mmd --print-identity` on the member.",
          "type": "string"
        },
        "host": {
          "type": "string"
        },
        "host-key": {
          "description": "The member's SSH public key, `<type> <base64>`.",
          "type": "string"
        },
        "port": {
          "type": "integer",
          "format": "uint16",
          "maximum": 65535,
          "minimum": 0
        }
      },
      "additionalProperties": false,
      "required": [
        "host",
        "host-key",
        "daemon-fingerprint"
      ]
    },
    "RepoTargetNode": {
      "description": "One host of a cluster target. Setup fills `host-key` and\n`daemon-fingerprint` through `mm target setup record`.",
      "type": "object",
      "properties": {
        "daemon-fingerprint": {
          "description": "Printed by `mmd --print-identity` on the node.",
          "type": [
            "string",
            "null"
          ]
        },
        "host": {
          "description": "The public address or DNS name mm connects to.",
          "type": "string"
        },
        "host-key": {
          "description": "The host's SSH public key, `<type> <base64>`.",
          "type": [
            "string",
            "null"
          ]
        },
        "name": {
          "description": "The node's hostname and Swarm node name: an RFC 1123 label.",
          "type": "string"
        },
        "port": {
          "type": "integer",
          "format": "uint16",
          "maximum": 65535,
          "minimum": 0
        },
        "private-address": {
          "description": "The node's address on the private network the Swarm uses.",
          "type": "string",
          "format": "ipv4"
        }
      },
      "additionalProperties": false,
      "required": [
        "name",
        "host",
        "private-address"
      ]
    },
    "RepoTargetSetup": {
      "description": "What setup installs on every node of a cluster target.",
      "type": "object",
      "properties": {
        "break-glass": {
          "description": "Recovery keys that are admin on every node.",
          "type": "array",
          "items": {
            "$ref": "#/$defs/RepoBreakGlassKey"
          }
        },
        "deploy-key": {
          "description": "The environment's read-only deploy key, shared by every node.",
          "anyOf": [
            {
              "$ref": "#/$defs/RepoDeployKey"
            },
            {
              "type": "null"
            }
          ]
        },
        "origin": {
          "description": "Git URL every node fetches the project from.",
          "type": "string"
        },
        "origin-host-key": {
          "description": "The git server's SSH host key, `<type> <base64>`; required for SSH origins.",
          "type": [
            "string",
            "null"
          ]
        },
        "user": {
          "description": "The account setup connects as; the operator's mm key is authorized for it.",
          "type": "string",
          "default": "root"
        }
      },
      "additionalProperties": false,
      "required": [
        "origin"
      ]
    },
    "RetryPolicyConfig": {
      "type": "object",
      "properties": {
        "attempts": {
          "type": "integer",
          "format": "uint16",
          "default": 1,
          "maximum": 65535,
          "minimum": 0
        },
        "backoff": {
          "type": "string",
          "default": "5s"
        },
        "max-backoff": {
          "type": "string",
          "default": "5m"
        }
      },
      "additionalProperties": false
    },
    "RuntimeConfig": {
      "type": "object",
      "properties": {
        "driver": {
          "anyOf": [
            {
              "$ref": "#/$defs/RuntimeKind"
            },
            {
              "type": "null"
            }
          ]
        }
      },
      "additionalProperties": false
    },
    "RuntimeKind": {
      "type": "string",
      "enum": [
        "podman-compose",
        "docker-compose",
        "docker-swarm"
      ]
    },
    "ScheduleConcurrency": {
      "type": "string",
      "enum": [
        "allow",
        "forbid",
        "replace"
      ]
    },
    "ScheduleConfig": {
      "type": "object",
      "properties": {
        "concurrency": {
          "$ref": "#/$defs/ScheduleConcurrency",
          "default": "forbid"
        },
        "cron": {
          "type": "string"
        },
        "enabled": {
          "type": "boolean",
          "default": true
        },
        "ends-at": {
          "type": [
            "string",
            "null"
          ]
        },
        "jitter": {
          "type": "string",
          "default": "0s"
        },
        "job": {
          "type": "string"
        },
        "misfire": {
          "$ref": "#/$defs/MisfirePolicy",
          "default": "run-once"
        },
        "retry": {
          "anyOf": [
            {
              "$ref": "#/$defs/RetryPolicyConfig"
            },
            {
              "type": "null"
            }
          ]
        },
        "starts-at": {
          "type": [
            "string",
            "null"
          ]
        },
        "timeout": {
          "type": [
            "string",
            "null"
          ]
        },
        "timezone": {
          "type": "string",
          "default": "UTC"
        }
      },
      "additionalProperties": false,
      "required": [
        "job",
        "cron"
      ]
    },
    "SecretBinding": {
      "type": "object",
      "properties": {
        "secret": {
          "type": "string"
        }
      },
      "additionalProperties": false,
      "required": [
        "secret"
      ]
    },
    "SecretDeclaration": {
      "type": "object",
      "properties": {
        "generate": {
          "description": "Present for generated secrets created by `mm secret generate`. Omit for operator-supplied values.",
          "anyOf": [
            {
              "$ref": "#/$defs/SecretGeneratorConfig"
            },
            {
              "type": "null"
            }
          ]
        },
        "input": {
          "description": "Hidden-input prompt for operator-supplied secrets set with `mm secret set` or `mm secret rotate`.",
          "anyOf": [
            {
              "$ref": "#/$defs/SecretInputConfig"
            },
            {
              "type": "null"
            }
          ]
        },
        "rotation": {
          "$ref": "#/$defs/SecretRotationConfig",
          "default": {
            "strategy": "manual"
          }
        },
        "storage": {
          "$ref": "#/$defs/SecretStorageConfig"
        }
      },
      "additionalProperties": false,
      "required": [
        "storage"
      ]
    },
    "SecretEncoding": {
      "type": "string",
      "enum": [
        "base64",
        "base64-url",
        "hex"
      ]
    },
    "SecretGeneratorConfig": {
      "oneOf": [
        {
          "type": "object",
          "properties": {
            "length": {
              "type": "integer",
              "format": "uint",
              "default": 32,
              "minimum": 0
            },
            "preset": {
              "type": "string",
              "const": "password"
            }
          },
          "additionalProperties": false,
          "required": [
            "preset"
          ]
        },
        {
          "type": "object",
          "properties": {
            "length": {
              "type": "integer",
              "format": "uint",
              "default": 48,
              "minimum": 0
            },
            "preset": {
              "type": "string",
              "const": "token"
            }
          },
          "additionalProperties": false,
          "required": [
            "preset"
          ]
        },
        {
          "type": "object",
          "properties": {
            "encoding": {
              "$ref": "#/$defs/SecretEncoding",
              "default": "base64-url"
            },
            "length": {
              "type": "integer",
              "format": "uint",
              "default": 32,
              "minimum": 0
            },
            "preset": {
              "type": "string",
              "const": "bytes"
            }
          },
          "additionalProperties": false,
          "required": [
            "preset"
          ]
        },
        {
          "type": "object",
          "properties": {
            "preset": {
              "type": "string",
              "const": "laravel-app-key"
            }
          },
          "additionalProperties": false,
          "required": [
            "preset"
          ]
        },
        {
          "type": "object",
          "properties": {
            "preset": {
              "type": "string",
              "const": "uuid"
            }
          },
          "additionalProperties": false,
          "required": [
            "preset"
          ]
        }
      ]
    },
    "SecretInputConfig": {
      "type": "object",
      "properties": {
        "prompt": {
          "type": "string"
        }
      },
      "additionalProperties": false,
      "required": [
        "prompt"
      ]
    },
    "SecretRotationConfig": {
      "type": "object",
      "properties": {
        "interval-days": {
          "type": [
            "integer",
            "null"
          ],
          "format": "uint32",
          "minimum": 0
        },
        "strategy": {
          "$ref": "#/$defs/SecretRotationStrategy",
          "default": "manual"
        }
      },
      "additionalProperties": false
    },
    "SecretRotationStrategy": {
      "type": "string",
      "enum": [
        "manual",
        "replace-and-redeploy",
        "coordinated"
      ]
    },
    "SecretStorageConfig": {
      "type": "object",
      "properties": {
        "location": {
          "type": "string"
        },
        "provider": {
          "$ref": "#/$defs/StorageProviderId"
        }
      },
      "additionalProperties": false,
      "required": [
        "provider",
        "location"
      ]
    },
    "ServiceConfig": {
      "type": "object",
      "properties": {
        "automatic-local-ingress": {
          "type": [
            "boolean",
            "null"
          ]
        },
        "development-mail": {
          "type": [
            "boolean",
            "null"
          ]
        },
        "env": {
          "type": "object",
          "additionalProperties": {
            "$ref": "#/$defs/EnvScalar"
          },
          "default": {}
        },
        "environments": {
          "description": "Environments in which this service runs; an empty list enables all.",
          "type": "array",
          "items": {
            "type": "string"
          }
        },
        "http-port": {
          "description": "A persisted HTTP selection made explicitly or by the guided editor.",
          "type": [
            "integer",
            "null"
          ],
          "format": "uint16",
          "maximum": 65535,
          "minimum": 0
        },
        "local-https": {
          "type": [
            "boolean",
            "null"
          ]
        },
        "networks": {
          "type": "array",
          "items": {
            "type": "string"
          }
        },
        "placement": {
          "description": "Where this service runs on a multi-node Swarm: a node hostname, a\nplacement group, `managers`, or a list that must all hold. Other\nruntimes and single-node clusters ignore it.",
          "anyOf": [
            {
              "$ref": "#/$defs/PlacementSpec"
            },
            {
              "type": "null"
            }
          ]
        },
        "role": {
          "anyOf": [
            {
              "$ref": "#/$defs/ServiceRole"
            },
            {
              "type": "null"
            }
          ]
        },
        "secret-files": {
          "type": "object",
          "additionalProperties": {
            "$ref": "#/$defs/ServiceSecretFileConfig"
          }
        },
        "stack": {
          "type": "string"
        }
      },
      "additionalProperties": false,
      "required": [
        "stack"
      ]
    },
    "ServiceRole": {
      "type": "string",
      "enum": [
        "http",
        "database",
        "queue",
        "worker",
        "scheduler",
        "job"
      ]
    },
    "ServiceSecretFileConfig": {
      "type": "object",
      "properties": {
        "gid": {
          "type": "string",
          "default": "0"
        },
        "mode": {
          "type": "integer",
          "format": "uint32",
          "default": 292,
          "minimum": 0
        },
        "secret": {
          "type": "string"
        },
        "uid": {
          "type": "string",
          "default": "0"
        }
      },
      "additionalProperties": false,
      "required": [
        "secret"
      ]
    },
    "ServiceSelection": {
      "description": "Services an add-on applies to: all of them, none, or a named list.",
      "anyOf": [
        {
          "type": "boolean"
        },
        {
          "type": "array",
          "items": {
            "type": "string"
          },
          "uniqueItems": true
        }
      ]
    },
    "StackConfig": {
      "type": "object",
      "properties": {
        "files": {
          "type": "array",
          "items": {
            "type": "string"
          }
        },
        "ingress": {
          "$ref": "#/$defs/IngressConfig"
        },
        "networks": {
          "type": "array",
          "items": {
            "type": "string"
          }
        },
        "project-name": {
          "type": [
            "string",
            "null"
          ]
        },
        "shared-volumes": {
          "description": "Compose volume keys that every node can mount. On a multi-node Swarm\nthey live on mm's built-in shared storage; elsewhere they are ordinary volumes.",
          "type": "array",
          "items": {
            "type": "string"
          }
        }
      },
      "additionalProperties": false,
      "required": [
        "files"
      ]
    },
    "StorageProviderId": {
      "type": "string"
    },
    "UserAccessConfig": {
      "anyOf": [
        {
          "$ref": "#/$defs/AccessLevel"
        },
        {
          "$ref": "#/$defs/EnvironmentAccess"
        }
      ]
    },
    "UserConfig": {
      "type": "object",
      "properties": {
        "access": {
          "description": "Level per environment name, or `*` for every remote environment.",
          "type": "object",
          "additionalProperties": {
            "$ref": "#/$defs/UserAccessConfig"
          },
          "default": {}
        },
        "keys": {
          "description": "OpenSSH public keys: `ssh-ed25519` or `sk-ssh-ed25519@openssh.com`.",
          "type": "array",
          "items": {
            "$ref": "#/$defs/UserKeyConfig"
          }
        },
        "machine": {
          "description": "A CI or automation identity rather than a person.",
          "type": "boolean"
        }
      },
      "additionalProperties": false,
      "required": [
        "keys"
      ]
    },
    "UserKeyConfig": {
      "anyOf": [
        {
          "type": "string"
        },
        {
          "type": "object",
          "properties": {
            "agent": {
              "description": "The key of this user's AI agent (`mm key create --agent`). It gets\nthe user's access limited by the `agents:` block, never more.",
              "type": "boolean"
            },
            "expires": {
              "description": "`YYYY-MM-DD`; the key stops working at the start of that UTC day.",
              "type": [
                "string",
                "null"
              ]
            },
            "key": {
              "type": "string"
            }
          },
          "required": [
            "key"
          ]
        }
      ]
    },
    "ValueBinding": {
      "type": "object",
      "properties": {
        "value": {
          "$ref": "#/$defs/EnvScalar"
        }
      },
      "additionalProperties": false,
      "required": [
        "value"
      ]
    },
    "ValueCast": {
      "type": "string",
      "enum": [
        "url"
      ]
    },
    "WireguardNetwork": {
      "type": "object",
      "properties": {
        "interface": {
          "type": "string",
          "default": "wg0"
        },
        "port": {
          "type": "integer",
          "format": "uint16",
          "default": 51820,
          "maximum": 65535,
          "minimum": 0
        },
        "subnet": {
          "description": "Holds every node's private address.",
          "$ref": "#/$defs/Ipv4Cidr"
        }
      },
      "additionalProperties": false,
      "required": [
        "subnet"
      ]
    }
  }
}