{
  "$defs": {
    "BoolFalse": {
      "const": false,
      "type": "boolean"
    },
    "BuildConfig": {
      "description": "Build configuration options for a project",
      "properties": {
        "args": {
          "description": "Build arguments to pass to the build\nFormat: KEY=VALUE or KEY (to pass from environment)",
          "items": {
            "type": "string"
          },
          "type": [
            "array",
            "null"
          ]
        },
        "backend": {
          "description": "Build backend (docker, docker:build, docker:buildx, buildctl, pack, railpack[:buildx], railpack:buildctl)",
          "type": [
            "string",
            "null"
          ]
        },
        "build_context": {
          "description": "Default build context (docker/podman only) - the context directory for the build\nThis is the path argument to `docker build <path>`. Defaults to rise.toml location.\nPath is relative to the rise.toml file location.",
          "type": [
            "string",
            "null"
          ]
        },
        "build_contexts": {
          "additionalProperties": {
            "type": "string"
          },
          "default": null,
          "description": "Build contexts (docker/podman only) - additional named contexts for multi-stage builds\nFormat: { \"name\" = \"path\" } where path is relative to the rise.toml file location",
          "type": [
            "object",
            "null"
          ]
        },
        "builder": {
          "description": "Buildpack builder to use (only for pack backend)",
          "type": [
            "string",
            "null"
          ]
        },
        "buildpacks": {
          "description": "Buildpack(s) to use (only for pack backend)",
          "items": {
            "type": "string"
          },
          "type": [
            "array",
            "null"
          ]
        },
        "container_cli": {
          "description": "Container CLI to use (docker or podman)",
          "type": [
            "string",
            "null"
          ]
        },
        "dockerfile": {
          "description": "Path to Dockerfile (relative to rise.toml location). Defaults to \"Dockerfile\" or \"Containerfile\"",
          "type": [
            "string",
            "null"
          ]
        },
        "managed_buildkit": {
          "description": "Enable managed BuildKit daemon with SSL certificate support",
          "type": [
            "boolean",
            "null"
          ]
        },
        "no_cache": {
          "description": "Disable build cache",
          "type": [
            "boolean",
            "null"
          ]
        },
        "platform": {
          "description": "Target platform for the container image build (e.g., \"linux/amd64\", \"linux/arm64\").\nDefaults to linux/amd64.",
          "type": [
            "string",
            "null"
          ]
        }
      },
      "type": "object"
    },
    "ContainerConfig": {
      "description": "Configuration for one container in a multi-container deployment.",
      "properties": {
        "build": {
          "anyOf": [
            {
              "$ref": "#/$defs/BuildConfig"
            },
            {
              "type": "null"
            }
          ],
          "description": "Build configuration to produce this container's image. Exclusive with `image`."
        },
        "deploy": {
          "anyOf": [
            {
              "$ref": "#/$defs/DeployConfig"
            },
            {
              "type": "null"
            }
          ],
          "default": null,
          "description": "Deployment resource configuration (replicas, cpu, memory, health_check).\nMirrors the top-level `[deploy]` table; unset fields inherit the\ntop-level `[deploy]` defaults."
        },
        "env": {
          "additionalProperties": {
            "type": "string"
          },
          "default": {},
          "description": "Plain-text environment variables scoped to this container. Merged on top\nof any project-level env vars; container-scoped values win on conflict.",
          "type": "object"
        },
        "image": {
          "description": "Pre-built image reference. Exclusive with `build`.",
          "type": [
            "string",
            "null"
          ]
        },
        "port": {
          "description": "Port the container listens on. Required if the container should be\nreachable via the ingress (referenced from `[routes]`) or by sibling\ncontainers via `RISE_CONTAINER_HOST__*`. Need not be HTTP — the Service\nis plain TCP. Omit for workers.",
          "format": "uint16",
          "maximum": 65535,
          "minimum": 0,
          "type": [
            "integer",
            "null"
          ]
        }
      },
      "type": "object"
    },
    "DeployConfig": {
      "description": "Deployment resource configuration.\n\nShared by the top-level `[deploy]`, per-environment `[environments.<name>.deploy]`,\nand per-container `[containers.<name>.deploy]` tables. Top-level values act as\ndefaults that each container inherits per field.",
      "properties": {
        "cpu": {
          "description": "CPU allocation. Either a fixed value that sets both the K8s request and\nlimit (e.g. `\"500m\"`, `\"1\"`), or a `request-limit` range (e.g. `\"128m-1\"`\n→ request `128m`, limit `1`). The request may not exceed the limit, and\nthe limit is validated against the environment/platform allowed range.",
          "type": [
            "string",
            "null"
          ]
        },
        "health_check": {
          "anyOf": [
            {
              "$ref": "#/$defs/HealthCheckSetting"
            },
            {
              "type": "null"
            }
          ],
          "description": "Health check configuration. HTTP liveness+readiness probes are disabled\nby default — they must be explicitly configured here. Set a config block\nto enable probes with a custom path/timing, or `health_check = false` to\nexplicitly mark them disabled. At the container level this requires the\ncontainer to have a `port`."
        },
        "memory": {
          "description": "Memory allocation. Either a fixed value that sets both the K8s request\nand limit (e.g. `\"256Mi\"`, `\"1Gi\"`), or a `request-limit` range (e.g.\n`\"64Mi-256Mi\"`). Same request/limit and range rules as `cpu`.",
          "type": [
            "string",
            "null"
          ]
        },
        "replicas": {
          "description": "Number of replicas",
          "format": "uint32",
          "minimum": 0,
          "type": [
            "integer",
            "null"
          ]
        }
      },
      "type": "object"
    },
    "EnvironmentConfig": {
      "description": "Per-environment configuration",
      "properties": {
        "default": {
          "default": false,
          "description": "Whether this is the default environment for local deployments",
          "type": "boolean"
        },
        "deploy": {
          "anyOf": [
            {
              "$ref": "#/$defs/DeployConfig"
            },
            {
              "type": "null"
            }
          ],
          "default": null,
          "description": "Environment-specific deployment resource overrides"
        },
        "env": {
          "additionalProperties": {
            "type": "string"
          },
          "default": {},
          "description": "Plain-text environment variables scoped to this environment",
          "type": "object"
        }
      },
      "type": "object"
    },
    "HealthCheckConfig": {
      "description": "Health-check configuration block. All fields are optional and fall back to\nthe server's `HealthProbeConfig` defaults (path `/`, 10s initial delay, …).",
      "properties": {
        "failure_threshold": {
          "description": "Consecutive failures before the probe is considered failed.",
          "format": "int32",
          "type": [
            "integer",
            "null"
          ]
        },
        "initial_delay_seconds": {
          "description": "Seconds after container start before the first probe.",
          "format": "int32",
          "type": [
            "integer",
            "null"
          ]
        },
        "liveness_enabled": {
          "description": "Enable liveness probe (default true).",
          "type": [
            "boolean",
            "null"
          ]
        },
        "path": {
          "description": "HTTP path to probe (default `/`).",
          "type": [
            "string",
            "null"
          ]
        },
        "period_seconds": {
          "description": "Seconds between probes.",
          "format": "int32",
          "type": [
            "integer",
            "null"
          ]
        },
        "readiness_enabled": {
          "description": "Enable readiness probe (default true).",
          "type": [
            "boolean",
            "null"
          ]
        },
        "timeout_seconds": {
          "description": "Probe timeout in seconds.",
          "format": "int32",
          "type": [
            "integer",
            "null"
          ]
        }
      },
      "type": "object"
    },
    "HealthCheckSetting": {
      "anyOf": [
        {
          "$ref": "#/$defs/BoolFalse",
          "description": "Pass `false` to disable probes entirely. (Only the literal `false` is\naccepted; `true` is rejected so users always go through `Config`.)"
        },
        {
          "$ref": "#/$defs/HealthCheckConfig",
          "description": "Customised probe configuration."
        }
      ],
      "description": "`health_check` may either be `false` (probes disabled) or a config block."
    },
    "IdentityConfig": {
      "description": "Workload identity configuration",
      "properties": {
        "audiences": {
          "additionalProperties": {
            "type": "string"
          },
          "default": {},
          "description": "Audiences to auto-mint workload identity tokens for and mount as files.\nMap key = in-pod token filename, value = the token audience.",
          "type": "object"
        }
      },
      "type": "object"
    },
    "ProjectConfig": {
      "description": "Project metadata configuration",
      "properties": {
        "env": {
          "additionalProperties": {
            "type": "string"
          },
          "default": {},
          "description": "Plain-text environment variables (non-secret)",
          "type": "object"
        },
        "name": {
          "description": "Project name",
          "type": "string"
        }
      },
      "required": [
        "name"
      ],
      "type": "object"
    },
    "RouteAccess": {
      "description": "Per-route access spelling used in `.rise.toml` `[routes].access`.\n\nA route's auth requirement reads more naturally as `public` than the\naccess-class `None` (\"no access\" vs. \"no requirement\" is ambiguous), so the\nconfig surface uses this lowercase enum and maps it to [`AccessRequirement`]\nwhen the route is resolved. Only the spelling differs — the semantics are\nidentical.",
      "oneOf": [
        {
          "const": "public",
          "description": "Open to everyone — no authentication (maps to [`AccessRequirement::None`]).",
          "type": "string"
        },
        {
          "const": "authenticated",
          "description": "Any authenticated user.",
          "type": "string"
        },
        {
          "const": "member",
          "description": "Project owner or team member only.",
          "type": "string"
        }
      ]
    },
    "RouteConfig": {
      "description": "One ingress path → container mapping.",
      "properties": {
        "access": {
          "anyOf": [
            {
              "$ref": "#/$defs/RouteAccess"
            },
            {
              "type": "null"
            }
          ],
          "description": "Per-route override of the ingress auth requirement (`public` /\n`authenticated` / `member`). Overrides *only* the access requirement for\nthis route's path — the project access class's `ingress_class` and\n`custom_annotations` are per-host and always apply project-wide. When\nabsent, the route inherits the project's requirement. Lets a single route\nbe opened (`public`) or tightened (`member`) relative to the rest of the\nproject."
        },
        "container": {
          "description": "Target container name (must exist in `[containers]` and have `port` set).\nThe route's port is always the target container's `port`.",
          "type": "string"
        }
      },
      "required": [
        "container"
      ],
      "type": "object"
    }
  },
  "$schema": "https://json-schema.org/draft/2020-12/schema",
  "description": "Root structure for rise.toml / .rise.toml configuration file",
  "properties": {
    "build": {
      "anyOf": [
        {
          "$ref": "#/$defs/BuildConfig"
        },
        {
          "type": "null"
        }
      ],
      "default": null,
      "description": "Build configuration (optional)"
    },
    "containers": {
      "additionalProperties": {
        "$ref": "#/$defs/ContainerConfig"
      },
      "description": "Multi-container configuration. When non-empty, the top-level `[build]`\nand `[deploy]` tables act as defaults that each container inherits per\nfield (see `ContainerConfig`). Each container becomes a separate K8s\nDeployment so replica counts scale independently.",
      "type": "object"
    },
    "deploy": {
      "anyOf": [
        {
          "$ref": "#/$defs/DeployConfig"
        },
        {
          "type": "null"
        }
      ],
      "default": null,
      "description": "Deployment resource configuration (optional)"
    },
    "environments": {
      "additionalProperties": {
        "$ref": "#/$defs/EnvironmentConfig"
      },
      "default": {},
      "description": "Per-environment configuration (optional)",
      "type": "object"
    },
    "identity": {
      "anyOf": [
        {
          "$ref": "#/$defs/IdentityConfig"
        },
        {
          "type": "null"
        }
      ],
      "default": null,
      "description": "Workload identity configuration (optional)"
    },
    "project": {
      "anyOf": [
        {
          "$ref": "#/$defs/ProjectConfig"
        },
        {
          "type": "null"
        }
      ],
      "default": null,
      "description": "Project metadata (optional)"
    },
    "routes": {
      "additionalProperties": {
        "$ref": "#/$defs/RouteConfig"
      },
      "description": "Path-based ingress routing across containers. Path strings are the keys\n(e.g. `\"/api\"`, `\"/\"`); the value picks the target container. The route's\nport is always the target container's `port`.",
      "type": "object"
    },
    "version": {
      "description": "Optional version (must be 1 if present)",
      "format": "uint32",
      "minimum": 0,
      "type": [
        "integer",
        "null"
      ]
    }
  },
  "title": "ProjectBuildConfig",
  "type": "object"
}