{
  "$schema": "http://json-schema.org/draft-07/schema#",
  "$id": "https://www.anguskit.com/schema/angusmeter/plugins/angus-graphql.json",
  "type": "object",
  "properties": {
    "url": {
      "type": "string",
      "format": "uri",
      "description": "GraphQL endpoint URL; supports ${var} interpolation"
    },
    "query": {
      "type": "string",
      "description": "GraphQL query or mutation document; supports ${var} interpolation"
    },
    "operationType": {
      "type": "string",
      "enum": [
        "QUERY",
        "MUTATION",
        "SUBSCRIPTION"
      ],
      "default": "QUERY",
      "description": "QUERY/MUTATION send HTTP POST; SUBSCRIPTION is reserved for future WebSocket transport (currently rejected at validation)"
    },
    "operationName": {
      "type": "string",
      "description": "Named operation within a multi-operation document"
    },
    "variables": {
      "type": [
        "object",
        "string"
      ],
      "additionalProperties": true,
      "description": "GraphQL variables map or JSON string; supports ${var} interpolation in both forms"
    },
    "headers": {
      "type": "object",
      "additionalProperties": {
        "type": "string"
      },
      "description": "Extra HTTP headers; values support ${var} interpolation"
    },
    "timeout": {
      "type": "integer",
      "minimum": 1,
      "maximum": 300,
      "default": 30,
      "description": "Request timeout in seconds (1-300)"
    },
    "auth": {
      "type": "object",
      "description": "Authentication shortcut (equivalent to setting Authorization header manually)",
      "properties": {
        "type": {
          "type": "string",
          "enum": [
            "BEARER",
            "BASIC"
          ],
          "description": "Authentication type"
        },
        "token": {
          "type": "string",
          "description": "Bearer token (required when type=BEARER); supports ${var}",
          "writeOnly": true
        },
        "username": {
          "type": "string",
          "description": "Username (required when type=BASIC); supports ${var}"
        },
        "password": {
          "type": "string",
          "description": "Password (required when type=BASIC); supports ${var}",
          "writeOnly": true
        }
      },
      "required": [
        "type"
      ]
    },
    "subscription": {
      "type": "object",
      "description": "WebSocket subscription options — reserved for future use; SUBSCRIPTION operationType is currently unsupported",
      "properties": {
        "initPayload": {
          "type": [
            "object",
            "string"
          ],
          "description": "Payload for connection_init message"
        },
        "receiveCount": {
          "type": "integer",
          "minimum": 1,
          "default": 1,
          "description": "Number of subscription messages to collect"
        },
        "receiveTimeout": {
          "type": "integer",
          "minimum": 1,
          "default": 30,
          "description": "Seconds to wait for each subscription message"
        }
      }
    },
    "tls": {
      "type": "object",
      "description": "TLS/SSL settings for HTTPS endpoints. All fields are mapped through cloud.xcan.angus.spec.model.TlsConfig; provide keystore/truststore or PEM cert+key to enable mTLS.",
      "properties": {
        "trustAll": {
          "type": "boolean",
          "default": false,
          "description": "Disable certificate validation (test environments only; also disables hostname verification)"
        },
        "verifyHostname": {
          "type": "boolean",
          "default": true,
          "description": "When false, skip TLS hostname verification while keeping certificate validation"
        },
        "keystorePath": {
          "type": "string",
          "description": "Path to client keystore (JKS/PKCS12) for mTLS. Store format is inferred from the extension."
        },
        "keystorePassword": {
          "type": "string",
          "description": "Client keystore password.",
          "writeOnly": true
        },
        "truststorePath": {
          "type": "string",
          "description": "Path to custom trust store (JKS/PKCS12)."
        },
        "truststorePassword": {
          "type": "string",
          "description": "Trust store password.",
          "writeOnly": true
        },
        "certPath": {
          "type": "string",
          "description": "Path to PEM client certificate (with keyPath for mTLS)."
        },
        "keyPath": {
          "type": "string",
          "description": "Path to PEM PKCS#8 private key."
        },
        "keyPassword": {
          "type": "string",
          "description": "Password for encrypted PEM private key.",
          "writeOnly": true
        },
        "caPath": {
          "type": "string",
          "description": "Path to PEM CA bundle (alternative to truststorePath)."
        },
        "protocols": {
          "type": "array",
          "items": {
            "type": "string"
          },
          "description": "Allowed TLS protocol versions (e.g. [\"TLSv1.3\"])."
        },
        "ciphers": {
          "type": "array",
          "items": {
            "type": "string"
          },
          "description": "Allowed cipher suites."
        }
      }
    },
    "introspect": {
      "type": "boolean",
      "default": false,
      "description": "Run a lightweight introspection probe before the main operation (overhead is recorded in metadata.introspectionTimeMs)"
    },
    "maxResponseBodyBytes": {
      "type": "integer",
      "minimum": 1,
      "default": 10485760,
      "description": "Maximum response body size in bytes to retain (default 10 MB); larger responses are truncated and metadata.responseTruncated is set"
    }
  },
  "required": [
    "url",
    "query"
  ]
}