{
  "$schema": "http://json-schema.org/draft-07/schema#",
  "$id": "https://usedino.dev/schema.json",
  "title": "Dino Configuration",
  "description": "Configuration for .dino.yml — the Dino API quality scanner.",
  "type": "object",
  "properties": {
    "endpoint": {
      "type": "string",
      "format": "uri",
      "description": "Direct API endpoint URL for ad-hoc scans. Omit when using tenant."
    },
    "protocol": {
      "type": "string",
      "enum": ["graphql", "rest"],
      "default": "graphql",
      "description": "API protocol: graphql (introspection) or rest (OpenAPI)."
    },
    "specUrl": {
      "type": "string",
      "minLength": 1,
      "description": "OpenAPI spec URL or file path. Required when protocol is rest."
    },
    "tenant": {
      "type": "string",
      "description": "Tenant ID for multi-tenant deployments."
    },
    "environment": {
      "type": "string",
      "description": "Target environment name (e.g., staging, production)."
    },
    "format": {
      "type": "string",
      "enum": ["json", "markdown"],
      "default": "markdown",
      "description": "Output format. Markdown is human-readable; JSON is machine-readable."
    },
    "snapshotDir": {
      "type": "string",
      "default": ".dino/snapshots",
      "description": "Directory for schema snapshots (used by dino diff)."
    },
    "aiKey": {
      "type": "string",
      "description": "AI key for reasoning (or set DINO_AI_KEY when running scan)."
    },
    "autonomy": {
      "type": "object",
      "properties": {
        "level": {
          "type": "string",
          "enum": ["observe", "enforce"],
          "default": "observe",
          "description": "Shadow Mode autonomy level for dino watch."
        }
      },
      "additionalProperties": true
    },
    "auth": {
      "description": "Authentication for local scans. Prefer type: none | header | oauth2; legacy {enabled, role} retained for tenant RBAC.",
      "oneOf": [
        {
          "type": "object",
          "required": ["type"],
          "additionalProperties": false,
          "properties": {
            "type": { "const": "none" }
          }
        },
        {
          "type": "object",
          "required": ["type", "header", "valueEnv"],
          "additionalProperties": false,
          "properties": {
            "type": { "const": "header" },
            "header": {
              "type": "string",
              "minLength": 1,
              "description": "HTTP header name (e.g. Authorization)."
            },
            "scheme": {
              "type": "string",
              "minLength": 1,
              "description": "Optional scheme prefix (e.g. Bearer). Omit for a raw header value."
            },
            "valueEnv": {
              "type": "string",
              "minLength": 1,
              "description": "Environment variable holding the secret (never write the secret itself)."
            }
          }
        },
        {
          "type": "object",
          "required": ["type", "tokenEndpoint", "clientIdEnv", "clientSecretEnv"],
          "additionalProperties": false,
          "properties": {
            "type": { "const": "oauth2" },
            "tokenEndpoint": {
              "type": "string",
              "format": "uri",
              "description": "OAuth2 token endpoint URL (client_credentials grant)."
            },
            "clientIdEnv": {
              "type": "string",
              "minLength": 1,
              "description": "Environment variable name for the OAuth2 client id (never the secret value)."
            },
            "clientSecretEnv": {
              "type": "string",
              "minLength": 1,
              "description": "Environment variable name for the OAuth2 client secret (never the secret value)."
            },
            "scope": {
              "type": "string",
              "minLength": 1,
              "description": "Optional OAuth2 scope for the client_credentials request."
            }
          }
        },
        {
          "type": "object",
          "required": ["enabled"],
          "properties": {
            "enabled": {
              "type": "boolean",
              "description": "Legacy: enable authenticated scans for RBAC testing."
            },
            "role": {
              "type": "string",
              "minLength": 1,
              "default": "USER",
              "description": "Legacy: default auth role for scans."
            }
          },
          "additionalProperties": true
        }
      ]
    }
  },
  "additionalProperties": true
}