{
  "$schema": "https://json-schema.org/draft/2020-12/schema",
  "$id": "https://nexuscrm.dev/schemas/runtime-api-config-v2.json",
  "title": "NexusCRM Runtime API deployment configuration",
  "type": "object",
  "additionalProperties": false,
  "required": [
    "NEXUSCRM_RUNTIME_WORKLOAD_IDENTITY_TOKEN_FILE",
    "NEXUSCRM_RUNTIME_API_SIGNING_KEY_FILE",
    "NEXUSCRM_RUNTIME_API_SERVING_CONFIG_FILE",
    "NEXUSCRM_RUNTIME_API_TLS_CERTIFICATE_FILE",
    "NEXUSCRM_RUNTIME_API_TLS_PRIVATE_KEY_FILE"
  ],
  "properties": {
    "NEXUSCRM_RUNTIME_API_ADMIN_ADDR": {
      "type": "string",
      "pattern": "^\\S*:\\d{1,5}$",
      "default": ":9091",
      "description": "Operational HTTP listen address for live, ready, version, capabilities, and metrics."
    },
    "NEXUSCRM_RUNTIME_API_GRPC_ADDR": {
      "type": "string",
      "pattern": "^\\S*:\\d{1,5}$",
      "default": ":9090",
      "description": "Runtime gRPC listen address."
    },
    "NEXUSCRM_RUNTIME_API_ADMISSION_LIMIT": {
      "type": "string",
      "pattern": "^(?:[1-9]|[1-5][0-9]|6[0-4])$",
      "default": "16",
      "description": "Per-process fail-fast Platform admission bound; configurable up to 64 and not a wire field or route SLO."
    },
    "NEXUSCRM_RUNTIME_API_PROFILING_ENABLED": {
      "type": "string",
      "enum": ["true", "false"],
      "default": "false",
      "description": "Enable continuous block and mutex sampling. The admin listener must be loopback-only."
    },
    "NEXUSCRM_RUNTIME_API_SQL_DIAGNOSTICS_ENABLED": {
      "type": "string",
      "enum": ["true", "false"],
      "default": "false",
      "description": "Enable request-scoped Runtime and SQL timing diagnostics without logging SQL arguments."
    },
    "NEXUSCRM_RUNTIME_WORKLOAD_IDENTITY_TOKEN_FILE": {
      "type": "string",
      "pattern": "^/.*",
      "description": "Absolute path to the owner-only workload bearer secret used by the D1 Runtime authority."
    },
    "NEXUSCRM_RUNTIME_API_SIGNING_KEY_FILE": {
      "type": "string",
      "pattern": "^/.*",
      "description": "Absolute path to the owner-only Runtime Identity current/overlap signing-key document."
    },
    "NEXUSCRM_RUNTIME_API_SERVING_CONFIG_FILE": {
      "type": "string",
      "pattern": "^/.*",
      "description": "Absolute path to the immutable versioned D1 serving selection and capability-policy document."
    },
    "NEXUSCRM_RUNTIME_API_TLS_CERTIFICATE_FILE": {
      "type": "string",
      "pattern": "^/.*",
      "description": "Absolute path to the Runtime gRPC server certificate chain."
    },
    "NEXUSCRM_RUNTIME_API_TLS_PRIVATE_KEY_FILE": {
      "type": "string",
      "pattern": "^/.*",
      "description": "Absolute path to the owner-only Runtime gRPC server private key."
    }
  }
}