{
  "$defs": {
    "AgentInstructionStep": {
      "description": "Single step in agent instruction workflow.",
      "properties": {
        "action": {
          "description": "Action to perform (CLI command, URL, or description)",
          "title": "Action",
          "type": "string"
        },
        "description": {
          "description": "Human-readable context for the action",
          "title": "Description",
          "type": "string"
        },
        "params": {
          "anyOf": [
            {
              "additionalProperties": true,
              "type": "object"
            },
            {
              "type": "null"
            }
          ],
          "default": null,
          "description": "Optional parameters for API calls",
          "title": "Params"
        },
        "required": {
          "default": true,
          "description": "Whether this step is required or optional",
          "title": "Required",
          "type": "boolean"
        }
      },
      "required": [
        "action",
        "description"
      ],
      "title": "AgentInstructionStep",
      "type": "object"
    },
    "AgentInstructions": {
      "description": "Instructions for agents to obtain a secret.",
      "properties": {
        "summary": {
          "description": "Brief overview of the acquisition process",
          "title": "Summary",
          "type": "string"
        },
        "steps": {
          "description": "Step-by-step instructions",
          "items": {
            "$ref": "#/$defs/AgentInstructionStep"
          },
          "title": "Steps",
          "type": "array"
        },
        "prerequisites": {
          "anyOf": [
            {
              "items": {
                "type": "string"
              },
              "type": "array"
            },
            {
              "type": "null"
            }
          ],
          "default": null,
          "description": "Requirements before starting",
          "title": "Prerequisites"
        },
        "automation_hint": {
          "anyOf": [
            {
              "type": "string"
            },
            {
              "type": "null"
            }
          ],
          "default": null,
          "description": "Guidance on automation feasibility",
          "title": "Automation Hint"
        },
        "estimated_time": {
          "anyOf": [
            {
              "type": "string"
            },
            {
              "type": "null"
            }
          ],
          "default": null,
          "description": "Expected time to complete",
          "title": "Estimated Time"
        },
        "fallback": {
          "anyOf": [
            {
              "type": "string"
            },
            {
              "type": "null"
            }
          ],
          "default": null,
          "description": "What to do if automation fails",
          "title": "Fallback"
        },
        "required_tools": {
          "anyOf": [
            {
              "items": {
                "type": "string"
              },
              "type": "array"
            },
            {
              "type": "null"
            }
          ],
          "default": null,
          "description": "CLI tools or dependencies needed",
          "title": "Required Tools"
        },
        "documentation_url": {
          "anyOf": [
            {
              "type": "string"
            },
            {
              "type": "null"
            }
          ],
          "default": null,
          "description": "Link to official documentation",
          "title": "Documentation Url"
        }
      },
      "required": [
        "summary",
        "steps"
      ],
      "title": "AgentInstructions",
      "type": "object"
    },
    "AnthropicConfig": {
      "description": "Configuration for the Anthropic (Claude) LLM provider.",
      "properties": {
        "api_key": {
          "anyOf": [
            {
              "type": "string"
            },
            {
              "type": "null"
            }
          ],
          "default": null,
          "description": "Anthropic API key (prefer ANTHROPIC_API_KEY env var)",
          "title": "Api Key"
        },
        "model": {
          "default": "claude-3-5-sonnet-20241022",
          "description": "Anthropic model name",
          "title": "Model",
          "type": "string"
        },
        "timeout": {
          "default": 120,
          "description": "Request timeout in seconds",
          "exclusiveMinimum": 0,
          "title": "Timeout",
          "type": "integer"
        },
        "temperature": {
          "default": 0.7,
          "maximum": 1.0,
          "minimum": 0.0,
          "title": "Temperature",
          "type": "number"
        },
        "max_tokens": {
          "default": 4096,
          "exclusiveMinimum": 0,
          "title": "Max Tokens",
          "type": "integer"
        }
      },
      "title": "AnthropicConfig",
      "type": "object"
    },
    "AppConfig": {
      "description": "Application config block: Secretfile root ``config`` key or ``~/.config/secretzero/config.yml``.\n\nSame shape as the mergeable app config (llm, discovery, output). Used for\ncentralized configuration resolution: defaults \u2190 config.yml \u2190 Secretfile.config.",
      "properties": {
        "llm": {
          "$ref": "#/$defs/LLMConfig"
        },
        "discovery": {
          "$ref": "#/$defs/DiscoveryConfig"
        },
        "output": {
          "$ref": "#/$defs/OutputConfig"
        }
      },
      "title": "AppConfig",
      "type": "object"
    },
    "AuthKind": {
      "description": "Authentication kind for providers.",
      "enum": [
        "ambient",
        "token",
        "assume_role",
        "static"
      ],
      "title": "AuthKind",
      "type": "string"
    },
    "AuthProfile": {
      "description": "Authentication profile configuration.",
      "properties": {
        "kind": {
          "$ref": "#/$defs/AuthKind"
        },
        "config": {
          "additionalProperties": true,
          "title": "Config",
          "type": "object"
        }
      },
      "required": [
        "kind"
      ],
      "title": "AuthProfile",
      "type": "object"
    },
    "AzureOpenAIConfig": {
      "description": "Configuration for Azure-hosted OpenAI models.",
      "properties": {
        "api_key": {
          "anyOf": [
            {
              "type": "string"
            },
            {
              "type": "null"
            }
          ],
          "default": null,
          "description": "Azure OpenAI API key (prefer AZURE_OPENAI_API_KEY env var)",
          "title": "Api Key"
        },
        "endpoint": {
          "anyOf": [
            {
              "type": "string"
            },
            {
              "type": "null"
            }
          ],
          "default": null,
          "description": "Azure OpenAI endpoint URL (prefer AZURE_OPENAI_ENDPOINT env var)",
          "title": "Endpoint"
        },
        "deployment": {
          "anyOf": [
            {
              "type": "string"
            },
            {
              "type": "null"
            }
          ],
          "default": null,
          "description": "Azure deployment name (prefer AZURE_OPENAI_DEPLOYMENT env var)",
          "title": "Deployment"
        },
        "api_version": {
          "default": "2024-02-15-preview",
          "description": "Azure OpenAI API version",
          "title": "Api Version",
          "type": "string"
        },
        "timeout": {
          "default": 120,
          "exclusiveMinimum": 0,
          "title": "Timeout",
          "type": "integer"
        },
        "temperature": {
          "default": 0.7,
          "maximum": 1.0,
          "minimum": 0.0,
          "title": "Temperature",
          "type": "number"
        },
        "max_tokens": {
          "default": 4096,
          "exclusiveMinimum": 0,
          "title": "Max Tokens",
          "type": "integer"
        }
      },
      "title": "AzureOpenAIConfig",
      "type": "object"
    },
    "DiscoveryConfig": {
      "description": "Settings that control the AI-powered secret discovery process.",
      "properties": {
        "allow_script_execution": {
          "default": false,
          "description": "Enable/disable external script execution during discovery",
          "title": "Allow Script Execution",
          "type": "boolean"
        },
        "confidence_threshold": {
          "default": 0.6,
          "description": "Minimum confidence score to include a secret in the output",
          "maximum": 1.0,
          "minimum": 0.0,
          "title": "Confidence Threshold",
          "type": "number"
        },
        "max_files": {
          "default": 1000,
          "description": "Maximum number of files to scan",
          "exclusiveMinimum": 0,
          "title": "Max Files",
          "type": "integer"
        },
        "include_patterns": {
          "description": "Glob patterns for files to include in the scan",
          "items": {
            "type": "string"
          },
          "title": "Include Patterns",
          "type": "array"
        },
        "exclude_patterns": {
          "description": "Glob patterns for files to exclude from the scan",
          "items": {
            "type": "string"
          },
          "title": "Exclude Patterns",
          "type": "array"
        },
        "script_url": {
          "anyOf": [
            {
              "type": "string"
            },
            {
              "type": "null"
            }
          ],
          "default": null,
          "description": "URL for an external secret-detection script (optional)",
          "title": "Script Url"
        }
      },
      "title": "DiscoveryConfig",
      "type": "object"
    },
    "GeneratorConfig": {
      "description": "Generator configuration for secret values.",
      "properties": {
        "kind": {
          "$ref": "#/$defs/GeneratorKind"
        },
        "config": {
          "additionalProperties": true,
          "title": "Config",
          "type": "object"
        }
      },
      "required": [
        "kind"
      ],
      "title": "GeneratorConfig",
      "type": "object"
    },
    "GeneratorKind": {
      "description": "Generator kind for secret values.\n\nThis enum is intentionally *open*: unknown string values passed by\nthird-party bundles are accepted at runtime via :meth:`_missing_`\ninstead of raising a ``ValueError``.  Built-in kinds are enumerated\nbelow; bundle authors may declare any additional string as a kind.",
      "enum": [
        "static",
        "random_password",
        "random_string",
        "script",
        "api",
        "provider_backed",
        "github_pat"
      ],
      "title": "GeneratorKind",
      "type": "string"
    },
    "LLMConfig": {
      "description": "Top-level LLM configuration for AI-powered features.",
      "properties": {
        "default_provider": {
          "default": "ollama",
          "description": "Default LLM provider: ollama, openai, anthropic, azure_openai",
          "title": "Default Provider",
          "type": "string"
        },
        "providers": {
          "$ref": "#/$defs/LLMProviders"
        }
      },
      "title": "LLMConfig",
      "type": "object"
    },
    "LLMProviders": {
      "description": "Configures all available LLM provider backends.",
      "properties": {
        "ollama": {
          "$ref": "#/$defs/OllamaConfig"
        },
        "openai": {
          "$ref": "#/$defs/OpenAIConfig"
        },
        "anthropic": {
          "$ref": "#/$defs/AnthropicConfig"
        },
        "azure_openai": {
          "$ref": "#/$defs/AzureOpenAIConfig"
        }
      },
      "title": "LLMProviders",
      "type": "object"
    },
    "Metadata": {
      "description": "Metadata about the secrets configuration.",
      "properties": {
        "project": {
          "anyOf": [
            {
              "type": "string"
            },
            {
              "type": "null"
            }
          ],
          "default": null,
          "title": "Project"
        },
        "owner": {
          "anyOf": [
            {
              "type": "string"
            },
            {
              "type": "null"
            }
          ],
          "default": null,
          "title": "Owner"
        },
        "environments": {
          "items": {
            "type": "string"
          },
          "title": "Environments",
          "type": "array"
        },
        "compliance": {
          "items": {
            "type": "string"
          },
          "title": "Compliance",
          "type": "array"
        }
      },
      "title": "Metadata",
      "type": "object"
    },
    "OllamaConfig": {
      "description": "Configuration for a locally-hosted Ollama LLM server.",
      "properties": {
        "base_url": {
          "default": "http://localhost:11434",
          "description": "Base URL for the Ollama server",
          "title": "Base Url",
          "type": "string"
        },
        "model": {
          "default": "llama3.2:3b",
          "description": "Default model name for general tasks",
          "title": "Model",
          "type": "string"
        },
        "reasoning_model": {
          "anyOf": [
            {
              "type": "string"
            },
            {
              "type": "null"
            }
          ],
          "default": null,
          "description": "Model name for reasoning-intensive tasks (optional)",
          "title": "Reasoning Model"
        },
        "timeout": {
          "default": 120,
          "description": "Request timeout in seconds",
          "exclusiveMinimum": 0,
          "title": "Timeout",
          "type": "integer"
        },
        "temperature": {
          "default": 0.7,
          "description": "Generation temperature (0.0\u20131.0)",
          "maximum": 1.0,
          "minimum": 0.0,
          "title": "Temperature",
          "type": "number"
        },
        "max_tokens": {
          "default": 4096,
          "description": "Maximum number of tokens to generate",
          "exclusiveMinimum": 0,
          "title": "Max Tokens",
          "type": "integer"
        }
      },
      "title": "OllamaConfig",
      "type": "object"
    },
    "OpenAIConfig": {
      "description": "Configuration for the OpenAI LLM provider.",
      "properties": {
        "api_key": {
          "anyOf": [
            {
              "type": "string"
            },
            {
              "type": "null"
            }
          ],
          "default": null,
          "description": "OpenAI API key (prefer OPENAI_API_KEY env var)",
          "title": "Api Key"
        },
        "model": {
          "default": "gpt-4o-mini",
          "description": "OpenAI model name",
          "title": "Model",
          "type": "string"
        },
        "organization": {
          "anyOf": [
            {
              "type": "string"
            },
            {
              "type": "null"
            }
          ],
          "default": null,
          "description": "OpenAI organisation ID (optional)",
          "title": "Organization"
        },
        "timeout": {
          "default": 120,
          "description": "Request timeout in seconds",
          "exclusiveMinimum": 0,
          "title": "Timeout",
          "type": "integer"
        },
        "temperature": {
          "default": 0.7,
          "maximum": 1.0,
          "minimum": 0.0,
          "title": "Temperature",
          "type": "number"
        },
        "max_tokens": {
          "default": 4096,
          "exclusiveMinimum": 0,
          "title": "Max Tokens",
          "type": "integer"
        }
      },
      "title": "OpenAIConfig",
      "type": "object"
    },
    "OutputConfig": {
      "description": "Output formatting preferences.",
      "properties": {
        "format": {
          "default": "text",
          "description": "Default output format: text, json, yaml",
          "title": "Format",
          "type": "string"
        },
        "verbosity": {
          "default": 1,
          "description": "Verbosity level (0 = quiet, 3 = very verbose)",
          "maximum": 3,
          "minimum": 0,
          "title": "Verbosity",
          "type": "integer"
        },
        "color": {
          "default": true,
          "description": "Enable colour output",
          "title": "Color",
          "type": "boolean"
        }
      },
      "title": "OutputConfig",
      "type": "object"
    },
    "Provider": {
      "description": "Provider configuration for secret sources and targets.",
      "properties": {
        "kind": {
          "anyOf": [
            {
              "type": "string"
            },
            {
              "type": "null"
            }
          ],
          "default": null,
          "title": "Kind"
        },
        "auth": {
          "anyOf": [
            {
              "$ref": "#/$defs/ProviderAuth"
            },
            {
              "type": "null"
            }
          ],
          "default": null
        },
        "config": {
          "additionalProperties": true,
          "title": "Config",
          "type": "object"
        },
        "fallback_generator": {
          "anyOf": [
            {
              "type": "string"
            },
            {
              "type": "null"
            }
          ],
          "default": null,
          "title": "Fallback Generator"
        }
      },
      "title": "Provider",
      "type": "object"
    },
    "ProviderAuth": {
      "description": "Provider authentication configuration.",
      "properties": {
        "kind": {
          "anyOf": [
            {
              "$ref": "#/$defs/AuthKind"
            },
            {
              "type": "null"
            }
          ],
          "default": null
        },
        "config": {
          "additionalProperties": true,
          "title": "Config",
          "type": "object"
        },
        "fallback_generator": {
          "anyOf": [
            {
              "type": "string"
            },
            {
              "type": "null"
            }
          ],
          "default": null,
          "title": "Fallback Generator"
        },
        "profiles": {
          "additionalProperties": {
            "$ref": "#/$defs/AuthProfile"
          },
          "title": "Profiles",
          "type": "object"
        }
      },
      "title": "ProviderAuth",
      "type": "object"
    },
    "Secret": {
      "description": "Secret definition.",
      "properties": {
        "name": {
          "title": "Name",
          "type": "string"
        },
        "kind": {
          "title": "Kind",
          "type": "string"
        },
        "vars": {
          "additionalProperties": true,
          "title": "Vars",
          "type": "object"
        },
        "config": {
          "additionalProperties": true,
          "title": "Config",
          "type": "object"
        },
        "one_time": {
          "default": false,
          "title": "One Time",
          "type": "boolean"
        },
        "rotation_period": {
          "anyOf": [
            {
              "type": "string"
            },
            {
              "type": "null"
            }
          ],
          "default": null,
          "title": "Rotation Period"
        },
        "targets": {
          "items": {
            "$ref": "#/$defs/TargetConfig"
          },
          "title": "Targets",
          "type": "array"
        },
        "agent_instructions": {
          "anyOf": [
            {
              "$ref": "#/$defs/AgentInstructions"
            },
            {
              "type": "null"
            }
          ],
          "default": null,
          "description": "Instructions for agents to obtain this secret"
        }
      },
      "required": [
        "name",
        "kind"
      ],
      "title": "Secret",
      "type": "object"
    },
    "TargetConfig": {
      "description": "Target storage configuration.",
      "properties": {
        "provider": {
          "title": "Provider",
          "type": "string"
        },
        "kind": {
          "anyOf": [
            {
              "$ref": "#/$defs/TargetKind"
            },
            {
              "type": "string"
            }
          ],
          "title": "Kind"
        },
        "config": {
          "additionalProperties": true,
          "title": "Config",
          "type": "object"
        }
      },
      "required": [
        "provider",
        "kind"
      ],
      "title": "TargetConfig",
      "type": "object"
    },
    "TargetKind": {
      "description": "Target storage kind.\n\nThis enum is intentionally *open*: unknown string values passed by\nthird-party bundles are accepted at runtime via :meth:`_missing_`\ninstead of raising a ``ValueError``.  Built-in kinds are enumerated\nbelow; bundle authors may declare any additional string as a kind.",
      "enum": [
        "file",
        "template",
        "ssm_parameter",
        "secrets_manager",
        "vault_kv",
        "azure_keyvault",
        "kubernetes_secret",
        "github_secret",
        "gitlab_variable",
        "jenkins_credential"
      ],
      "title": "TargetKind",
      "type": "string"
    },
    "Template": {
      "description": "Secret template definition.",
      "properties": {
        "description": {
          "title": "Description",
          "type": "string"
        },
        "fields": {
          "additionalProperties": {
            "$ref": "#/$defs/TemplateField"
          },
          "title": "Fields",
          "type": "object"
        },
        "targets": {
          "items": {
            "$ref": "#/$defs/TargetConfig"
          },
          "title": "Targets",
          "type": "array"
        }
      },
      "required": [
        "description",
        "fields"
      ],
      "title": "Template",
      "type": "object"
    },
    "TemplateField": {
      "description": "Template field definition.",
      "properties": {
        "description": {
          "title": "Description",
          "type": "string"
        },
        "generator": {
          "$ref": "#/$defs/GeneratorConfig"
        },
        "targets": {
          "items": {
            "$ref": "#/$defs/TargetConfig"
          },
          "title": "Targets",
          "type": "array"
        }
      },
      "required": [
        "description",
        "generator"
      ],
      "title": "TemplateField",
      "type": "object"
    }
  },
  "description": "Root configuration model for Secretfile.yml.",
  "properties": {
    "version": {
      "title": "Version",
      "type": "string"
    },
    "variables": {
      "additionalProperties": true,
      "title": "Variables",
      "type": "object"
    },
    "metadata": {
      "anyOf": [
        {
          "$ref": "#/$defs/Metadata"
        },
        {
          "type": "null"
        }
      ],
      "default": null
    },
    "providers": {
      "additionalProperties": {
        "$ref": "#/$defs/Provider"
      },
      "title": "Providers",
      "type": "object"
    },
    "secrets": {
      "items": {
        "$ref": "#/$defs/Secret"
      },
      "title": "Secrets",
      "type": "array"
    },
    "templates": {
      "additionalProperties": {
        "$ref": "#/$defs/Template"
      },
      "title": "Templates",
      "type": "object"
    },
    "policies": {
      "additionalProperties": true,
      "title": "Policies",
      "type": "object"
    },
    "labels": {
      "additionalProperties": true,
      "title": "Labels",
      "type": "object"
    },
    "annotations": {
      "additionalProperties": true,
      "title": "Annotations",
      "type": "object"
    },
    "config": {
      "anyOf": [
        {
          "$ref": "#/$defs/AppConfig"
        },
        {
          "type": "null"
        }
      ],
      "default": null,
      "description": "Optional centralized app config (LLM, discovery, output); overrides config.yml and defaults"
    }
  },
  "required": [
    "version"
  ],
  "title": "Secretfile",
  "type": "object"
}
