{
  "$schema": "https://json-schema.org/draft/2020-12/schema",
  "$id": "https://schemas.synq.io/synq-scout/v1/config.schema.json",
  "$defs": {
    "AthenaConf": {
      "properties": {
        "region": {
          "type": "string",
          "description": "AWS region hosting the Athena service and Glue Data Catalog."
        },
        "workgroup": {
          "type": "string",
          "description": "Athena workgroup. Defaults to \"primary\" when empty. Must have a\nResultConfiguration.OutputLocation configured."
        },
        "catalog": {
          "type": "string",
          "description": "Glue Data Catalog name. Defaults to \"AwsDataCatalog\" when empty."
        },
        "access_key_id": {
          "type": "string",
          "description": "Static AWS credentials. Pair access_key_id with secret_access_key."
        },
        "secret_access_key": {
          "type": "string"
        },
        "session_token": {
          "type": "string",
          "description": "Optional STS session token, when access_key_id+secret_access_key are\nshort-lived STS credentials."
        },
        "aws_profile": {
          "type": "string",
          "description": "Named AWS shared-config profile (from ~/.aws/credentials or\n~/.aws/config). Used only when static credentials are absent."
        },
        "role_arn": {
          "type": "string",
          "description": "IAM role ARN to assume via STS. Wraps whichever base credentials\nresolved above (or the host's default chain when no other auth is set)."
        },
        "external_id": {
          "type": "string",
          "description": "External ID required by the role's trust policy. Pair with role_arn."
        },
        "role_session_name": {
          "type": "string",
          "description": "Optional STS session name. Defaults to \"synq-athena\"."
        },
        "scope": {
          "$ref": "#/$defs/ScopeConf",
          "description": "Scope filter for include/exclude filtering by Glue catalog, Glue\ndatabase, and table. Mapping: ScopeRule.database = Glue catalog,\nScopeRule.schema = Glue database, ScopeRule.table = Glue table/view."
        },
        "use_show_create_table": {
          "type": "boolean",
          "description": "Use SHOW CREATE TABLE to retrieve full table DDL (CTAS bodies, Iceberg\nTBLPROPERTIES, Hive external LOCATION/SerDe). One Athena query per\ntable — billed at the 10MB scan minimum each."
        },
        "use_show_create_view": {
          "type": "boolean",
          "description": "Use SHOW CREATE VIEW to retrieve full view DDL instead of the\nrewritten body from information_schema.views.view_definition."
        },
        "use_iceberg_metrics_scan": {
          "type": "boolean",
          "description": "For Iceberg tables, fan out one Athena query per table to read row\ncount, total file size, snapshot commit timestamp, and partition\ncolumns from the table's $files / $snapshots / $partitions metadata\ntables. Hive externals are unaffected."
        }
      },
      "additionalProperties": false,
      "type": "object",
      "required": [
        "region"
      ],
      "description": "AthenaConf contains Amazon Athena connection parameters."
    },
    "BigQueryConf": {
      "properties": {
        "project_id": {
          "type": "string",
          "description": "GCP project ID."
        },
        "region": {
          "type": "string",
          "description": "Region for BigQuery resources."
        },
        "service_account_key": {
          "type": "string",
          "description": "Inline JSON content of the service account key."
        },
        "service_account_key_file": {
          "type": "string",
          "description": "Path to the service account key JSON file."
        },
        "datasets": {
          "items": {
            "type": "string"
          },
          "type": "array",
          "description": "Explicit list of dataset names to scrape. When set, only these datasets are queried\nand project-level bigquery.datasets.list permission is not required."
        }
      },
      "additionalProperties": false,
      "type": "object",
      "required": [
        "project_id",
        "region"
      ],
      "description": "BigQueryConf contains BigQuery connection parameters."
    },
    "ClickhouseConf": {
      "properties": {
        "host": {
          "type": "string"
        },
        "port": {
          "type": "integer",
          "maximum": 65535,
          "minimum": 1
        },
        "database": {
          "type": "string",
          "description": "Database to connect to. If empty, all databases are scraped."
        },
        "username": {
          "type": "string"
        },
        "password": {
          "type": "string"
        },
        "allow_insecure": {
          "type": "boolean",
          "description": "Disable SSL certificate verification."
        }
      },
      "additionalProperties": false,
      "type": "object",
      "required": [
        "host",
        "username",
        "password"
      ],
      "description": "ClickhouseConf contains ClickHouse connection parameters."
    },
    "Connection": {
      "properties": {
        "name": {
          "type": "string",
          "description": "Display name for this connection. Defaults to the connection ID (map key)."
        },
        "disabled": {
          "type": "boolean",
          "description": "When true, the connection is skipped during execution."
        },
        "parallelism": {
          "type": "integer",
          "maximum": 256,
          "minimum": 1,
          "description": "Maximum number of parallel queries. Range: 1-256. Defaults to 8."
        },
        "postgres": {
          "$ref": "#/$defs/PostgresConf"
        },
        "snowflake": {
          "$ref": "#/$defs/SnowflakeConf"
        },
        "bigquery": {
          "$ref": "#/$defs/BigQueryConf"
        },
        "redshift": {
          "$ref": "#/$defs/RedshiftConf"
        },
        "mysql": {
          "$ref": "#/$defs/MySQLConf"
        },
        "clickhouse": {
          "$ref": "#/$defs/ClickhouseConf"
        },
        "trino": {
          "$ref": "#/$defs/TrinoConf"
        },
        "databricks": {
          "$ref": "#/$defs/DatabricksConf"
        },
        "mssql": {
          "$ref": "#/$defs/MSSQLConf"
        },
        "oracle": {
          "$ref": "#/$defs/OracleConf"
        },
        "duckdb": {
          "$ref": "#/$defs/DuckDBConf"
        },
        "athena": {
          "$ref": "#/$defs/AthenaConf"
        },
        "fabric": {
          "$ref": "#/$defs/FabricConf"
        }
      },
      "additionalProperties": false,
      "type": "object",
      "description": "Connection is a single database connection entry in a connections map."
    },
    "DatabricksConf": {
      "properties": {
        "workspace_url": {
          "type": "string",
          "description": "Databricks workspace URL."
        },
        "auth_token": {
          "type": "string",
          "description": "Personal access token for authentication."
        },
        "auth_client": {
          "type": "string",
          "description": "OAuth client ID (M2M authentication)."
        },
        "auth_secret": {
          "type": "string",
          "description": "OAuth client secret (M2M authentication)."
        },
        "warehouse": {
          "type": "string",
          "description": "SQL warehouse ID to use for queries."
        },
        "refresh_table_metrics": {
          "type": "boolean"
        },
        "refresh_table_metrics_use_scan": {
          "type": "boolean"
        },
        "fetch_table_tags": {
          "type": "boolean"
        },
        "use_show_create_table": {
          "type": "boolean"
        }
      },
      "additionalProperties": false,
      "type": "object",
      "required": [
        "workspace_url"
      ],
      "description": "DatabricksConf contains Databricks connection parameters."
    },
    "DuckDBConf": {
      "properties": {
        "database": {
          "type": "string",
          "description": "File path, ':memory:' for in-memory, or MotherDuck database name."
        },
        "motherduck_account": {
          "type": "string",
          "description": "MotherDuck organization/account name (for cloud mode)."
        },
        "motherduck_token": {
          "type": "string",
          "description": "MotherDuck authentication token (required for cloud MotherDuck)."
        }
      },
      "additionalProperties": false,
      "type": "object",
      "description": "DuckDBConf contains DuckDB / MotherDuck connection parameters."
    },
    "FabricConf": {
      "properties": {
        "host": {
          "type": "string",
          "description": "Hostname of the workspace's SQL analytics endpoint. Copy it from the\nFabric portal: open your Warehouse or Lakehouse, then Settings → SQL\nconnection string.",
          "examples": [
            "my-workspace.datawarehouse.fabric.microsoft.com"
          ]
        },
        "database": {
          "type": "string",
          "description": "Default database for queries that don't name one explicitly. Optional —\ndefaults to \"master\". Because metadata and metric queries are always\nfully qualified, this only affects ad-hoc SQL that omits the database.",
          "examples": [
            "my_warehouse"
          ]
        },
        "auth_type": {
          "type": "string",
          "description": "How to authenticate to Fabric. Optional — defaults to a service principal\n(client_id + client_secret). Values are matched case-insensitively, and\nthe equivalent dbt-fabric and Microsoft ODBC spellings are also accepted:\n  - \"service_principal\" (default): Entra ID service principal. Set\n    client_id, client_secret and, if needed, tenant_id.\n  - \"azure_cli\": reuse the machine's `az login` session. On-prem agent only.\n  - \"default\": try Azure's default credential chain (environment, managed\n    identity, CLI, ...). On-prem agent only.\n  - \"managed_identity\": use an Azure managed identity; set client_id to\n    select a user-assigned identity. On-prem agent only.",
          "examples": [
            "service_principal",
            "azure_cli",
            "default",
            "managed_identity"
          ]
        },
        "client_id": {
          "type": "string",
          "description": "Application (client) ID of the Entra ID service principal. When auth_type\nis \"managed_identity\", this instead selects a user-assigned identity.",
          "examples": [
            "00000000-0000-0000-0000-000000000000"
          ]
        },
        "client_secret": {
          "type": "string",
          "description": "Client secret for the service principal. Supply it through an environment\nvariable (e.g. ${FABRIC_CLIENT_SECRET}) rather than committing it in plain\ntext.",
          "examples": [
            "${FABRIC_CLIENT_SECRET}"
          ]
        },
        "tenant_id": {
          "type": "string",
          "description": "Entra ID tenant (directory) ID. Optional — inferred from the endpoint\nhostname when omitted. Set it only when the service principal lives in a\ndifferent tenant than the workspace.",
          "examples": [
            "00000000-0000-0000-0000-000000000000"
          ]
        },
        "access_token": {
          "type": "string",
          "description": "A pre-acquired Entra ID OAuth access token for the SQL scope\n(https://database.windows.net/.default). Optional — when set it overrides\nevery other authentication method. Mainly for hosted deployments that mint\ntheir own token.",
          "examples": [
            "${FABRIC_ACCESS_TOKEN}"
          ]
        },
        "scope": {
          "$ref": "#/$defs/ScopeConf",
          "description": "Optional include/exclude filter that limits which databases, schemas and\ntables are scanned. When omitted, the whole workspace is scanned."
        }
      },
      "additionalProperties": false,
      "type": "object",
      "required": [
        "host"
      ],
      "description": "FabricConf contains the connection settings for a Microsoft Fabric Warehouse or Lakehouse SQL analytics endpoint."
    },
    "MSSQLConf": {
      "properties": {
        "host": {
          "type": "string"
        },
        "port": {
          "type": "integer",
          "maximum": 65535,
          "minimum": 1
        },
        "database": {
          "type": "string"
        },
        "username": {
          "type": "string"
        },
        "password": {
          "type": "string"
        },
        "trust_cert": {
          "type": "boolean",
          "description": "Trust the server certificate without validation."
        },
        "encrypt": {
          "type": "string",
          "description": "Encryption mode (e.g. \"true\", \"false\", \"strict\")."
        },
        "fed_auth": {
          "type": "string",
          "description": "Federated authentication method (e.g. \"ActiveDirectoryDefault\")."
        },
        "access_token": {
          "type": "string",
          "description": "Pre-acquired access token for Azure AD authentication."
        },
        "application_client_id": {
          "type": "string",
          "description": "Azure AD application client ID for service principal auth."
        }
      },
      "additionalProperties": false,
      "type": "object",
      "required": [
        "host",
        "database"
      ],
      "description": "MSSQLConf contains Microsoft SQL Server / Azure SQL Database connection parameters."
    },
    "MySQLConf": {
      "properties": {
        "host": {
          "type": "string"
        },
        "port": {
          "type": "integer",
          "maximum": 65535,
          "minimum": 1
        },
        "database": {
          "type": "string"
        },
        "username": {
          "type": "string"
        },
        "password": {
          "type": "string"
        },
        "allow_insecure": {
          "type": "boolean",
          "description": "Disable SSL certificate verification."
        },
        "params": {
          "additionalProperties": {
            "type": "string"
          },
          "type": "object",
          "description": "Additional DSN parameters passed to the driver."
        }
      },
      "additionalProperties": false,
      "type": "object",
      "required": [
        "host",
        "port",
        "username",
        "password"
      ],
      "description": "MySQLConf contains MySQL connection parameters."
    },
    "OracleConf": {
      "properties": {
        "host": {
          "type": "string"
        },
        "port": {
          "type": "integer",
          "maximum": 65535,
          "minimum": 1
        },
        "service_name": {
          "type": "string",
          "description": "Oracle service name."
        },
        "username": {
          "type": "string"
        },
        "password": {
          "type": "string"
        },
        "ssl": {
          "type": "boolean",
          "description": "Enable SSL/TLS for the connection."
        },
        "ssl_verify": {
          "type": "boolean",
          "description": "Verify the server's SSL certificate."
        },
        "wallet_path": {
          "type": "string",
          "description": "Path to Oracle Wallet directory for authentication."
        },
        "use_diagnostics_pack": {
          "type": "boolean",
          "description": "Enable Oracle Diagnostics Pack features (AWR, ASH)."
        }
      },
      "additionalProperties": false,
      "type": "object",
      "required": [
        "host",
        "service_name"
      ],
      "description": "OracleConf contains Oracle Database connection parameters."
    },
    "PostgresConf": {
      "properties": {
        "host": {
          "type": "string"
        },
        "port": {
          "type": "integer",
          "maximum": 65535,
          "minimum": 1
        },
        "database": {
          "type": "string"
        },
        "username": {
          "type": "string"
        },
        "password": {
          "type": "string"
        },
        "allow_insecure": {
          "type": "boolean",
          "description": "Disable SSL certificate verification."
        }
      },
      "additionalProperties": false,
      "type": "object",
      "required": [
        "host",
        "database",
        "username",
        "password"
      ],
      "description": "PostgresConf contains PostgreSQL connection parameters."
    },
    "RedshiftConf": {
      "properties": {
        "host": {
          "type": "string"
        },
        "port": {
          "type": "integer",
          "maximum": 65535,
          "minimum": 1
        },
        "database": {
          "type": "string"
        },
        "username": {
          "type": "string"
        },
        "password": {
          "type": "string"
        },
        "freshness_from_query_logs": {
          "type": "boolean",
          "description": "Estimate table freshness from Redshift query logs instead of metadata."
        }
      },
      "additionalProperties": false,
      "type": "object",
      "required": [
        "host",
        "port",
        "database",
        "username",
        "password"
      ],
      "description": "RedshiftConf contains Amazon Redshift connection parameters."
    },
    "SYNQConfig": {
      "properties": {
        "client_id": {
          "type": "string",
          "description": "OAuth client ID for authenticating with the SYNQ platform."
        },
        "client_secret": {
          "type": "string",
          "description": "OAuth client secret for authenticating with the SYNQ platform."
        },
        "endpoint": {
          "type": "string",
          "description": "gRPC endpoint for the SYNQ API (e.g. \"developer.synq.io:443\")."
        },
        "ingest_endpoint": {
          "type": "string",
          "description": "gRPC endpoint for the SYNQ ingest API. Defaults to Endpoint if empty."
        },
        "oauth_url": {
          "type": "string",
          "description": "OAuth token URL. Derived from Endpoint if empty."
        }
      },
      "additionalProperties": false,
      "type": "object",
      "description": "SYNQConfig holds SYNQ platform connection settings."
    },
    "ScopeConf": {
      "properties": {
        "include": {
          "items": {
            "$ref": "#/$defs/ScopeRuleConf"
          },
          "type": "array",
          "description": "Include rules. If non-empty, only matching objects are accepted."
        },
        "exclude": {
          "items": {
            "$ref": "#/$defs/ScopeRuleConf"
          },
          "type": "array",
          "description": "Exclude rules. Matching objects are rejected, even if they match an include rule."
        }
      },
      "additionalProperties": false,
      "type": "object",
      "description": "ScopeConf is the YAML representation of synq.common.v1.ScopeFilter — the shared include/exclude filter used by warehouses with hierarchical catalogs."
    },
    "ScopeRuleConf": {
      "properties": {
        "database": {
          "type": "string",
          "description": "Database-level pattern (catalog for Athena/Trino/Databricks, project for BigQuery)."
        },
        "schema": {
          "type": "string",
          "description": "Schema-level pattern (Glue database for Athena, dataset for BigQuery)."
        },
        "table": {
          "type": "string",
          "description": "Table or view name pattern."
        }
      },
      "additionalProperties": false,
      "type": "object",
      "description": "ScopeRuleConf is a single include/exclude rule."
    },
    "SnowflakeConf": {
      "properties": {
        "account": {
          "type": "string",
          "description": "Snowflake account identifier."
        },
        "warehouse": {
          "type": "string",
          "description": "Virtual warehouse to use for queries."
        },
        "role": {
          "type": "string",
          "description": "Role to assume after connecting."
        },
        "username": {
          "type": "string"
        },
        "password": {
          "type": "string"
        },
        "private_key": {
          "type": "string",
          "description": "PEM-encoded private key content for key-pair authentication."
        },
        "private_key_file": {
          "type": "string",
          "description": "Path to a PEM-encoded private key file."
        },
        "private_key_passphrase": {
          "type": "string",
          "description": "Passphrase to decrypt the private key."
        },
        "databases": {
          "items": {
            "type": "string"
          },
          "type": "array",
          "description": "Databases to include. If empty, all accessible databases are scraped."
        },
        "use_get_ddl": {
          "type": "boolean",
          "description": "Use GET_DDL() to retrieve DDL for tables and views."
        },
        "account_usage_db": {
          "type": "string",
          "description": "Database containing the ACCOUNT_USAGE schema. Defaults to SNOWFLAKE."
        },
        "auth_type": {
          "type": "string",
          "description": "Set to \"externalbrowser\" to use SSO browser-based authentication."
        }
      },
      "additionalProperties": false,
      "type": "object",
      "required": [
        "account",
        "warehouse",
        "role",
        "username"
      ],
      "description": "SnowflakeConf contains Snowflake connection parameters."
    },
    "TrinoConf": {
      "properties": {
        "host": {
          "type": "string"
        },
        "port": {
          "type": "integer",
          "maximum": 65535,
          "minimum": 1
        },
        "use_plaintext": {
          "type": "boolean",
          "description": "Use a plain HTTP connection instead of HTTPS."
        },
        "username": {
          "type": "string"
        },
        "password": {
          "type": "string"
        },
        "catalogs": {
          "items": {
            "type": "string"
          },
          "type": "array",
          "description": "Catalogs to include. Required for most Trino deployments."
        },
        "no_show_create_view": {
          "type": "boolean"
        },
        "no_show_create_table": {
          "type": "boolean"
        },
        "no_materialized_views": {
          "type": "boolean"
        },
        "fetch_table_comments": {
          "type": "boolean"
        }
      },
      "additionalProperties": false,
      "type": "object",
      "required": [
        "host"
      ],
      "description": "TrinoConf contains Trino / Starburst connection parameters."
    },
    "YAMLLLMConfig": {
      "properties": {
        "openai": {
          "$ref": "#/$defs/YAMLOpenAIConfig",
          "description": "OpenAI-compatible API configuration (also used for LiteLLM proxy)."
        },
        "triage_parallelism": {
          "type": "integer",
          "description": "Number of parallel triage operations."
        },
        "test_suggestions_parallelism": {
          "type": "integer",
          "description": "Number of parallel test suggestion operations."
        }
      },
      "additionalProperties": false,
      "type": "object",
      "description": "YAMLLLMConfig contains LLM provider settings."
    },
    "YAMLOpenAIConfig": {
      "properties": {
        "api_key": {
          "type": "string",
          "description": "API key for the LLM provider."
        },
        "base_url": {
          "type": "string",
          "description": "Base URL for the API (e.g. LiteLLM proxy URL)."
        },
        "thinking_model": {
          "type": "string",
          "description": "Model used for deep thinking/analysis tasks."
        },
        "summary_model": {
          "type": "string",
          "description": "Model used for summarization tasks."
        }
      },
      "additionalProperties": false,
      "type": "object",
      "description": "YAMLOpenAIConfig contains OpenAI-compatible API settings."
    }
  },
  "properties": {
    "synq": {
      "$ref": "#/$defs/SYNQConfig"
    },
    "connections": {
      "additionalProperties": {
        "$ref": "#/$defs/Connection"
      },
      "type": "object"
    },
    "llm": {
      "$ref": "#/$defs/YAMLLLMConfig"
    }
  },
  "additionalProperties": false,
  "type": "object",
  "title": "Coalesce Quality Scout Agent Configuration",
  "description": "Configuration file format for synq-scout, the Coalesce Quality triage agent run on-premise: your data and the chosen LLM (e.g. an internal LiteLLM proxy, Google Vertex, or AWS Bedrock) stay within your environment, and only the triage resolution — not the underlying data or investigation — is sent back to Coalesce Quality. Defines the agent's data warehouse connections and LLM endpoint.",
  "x-status": "stable"
}