{
  "$schema": "http://json-schema.org/draft-07/schema#",
  "title": "twin OPC connection settings",
  "description": "Schema for opc-connection/<name>/settings.yml (or settings.yaml). Models the subset of Ignition's gateway connection JSON that twin reads, plus twin's own schemaVersion, minTwinVersion and diff keys. Other Ignition fields (description, enabled, collection, profile, keepAlive, advanced, security, failover, backupConfig, password, certificatePem, privateKeyPem, hostOverride) are accepted on input but not used, so a literal Ignition gateway export is a valid file.",
  "type": "object",
  "properties": {
    "schemaVersion": {
      "type": "integer",
      "enum": [1],
      "description": "On-disk format version of this file. Stamped by twin on every save. A missing value is treated as 1; a version newer than the running twin knows is refused."
    },
    "minTwinVersion": {
      "type": "string",
      "pattern": "^v?[0-9]+\\.[0-9]+\\.[0-9]+",
      "description": "Optional minimum twin binary version (x.y.z, optional leading v) required to load this connection. Compared on x.y.z only. Dev builds without a parseable version are exempt."
    },
    "name": {
      "type": "string",
      "description": "Connection name. Falls back to the directory name under opc-connection/ when omitted; should match it. Drives the OPCUA_BROWSER_<NAME>_USERNAME / _PASSWORD environment variable names, the ?connection= URL parameter, and settings.twin.yml's defaultConnection."
    },
    "config": {
      "type": "object",
      "properties": {
        "settings": {
          "type": "object",
          "properties": {
            "endpoint": {
              "type": "object",
              "properties": {
                "endpointUrl": {
                  "type": "string",
                  "format": "uri",
                  "description": "OPC UA endpoint URL twin dials. Example: opc.tcp://bel-edge.lsg.no:4840"
                },
                "discoveryUrl": {
                  "type": "string",
                  "description": "Optional discovery URL used by GetEndpoints. Falls back to endpointUrl when empty."
                },
                "securityPolicy": {
                  "type": "string",
                  "description": "OPC UA security policy short name. Defaults to None when omitted.",
                  "enum": [
                    "None",
                    "Basic128Rsa15",
                    "Basic256",
                    "Basic256Sha256",
                    "Aes128_Sha256_RsaOaep",
                    "Aes256_Sha256_RsaPss"
                  ]
                },
                "securityMode": {
                  "type": "string",
                  "description": "OPC UA message security mode. Defaults to None when omitted.",
                  "enum": ["None", "Sign", "SignAndEncrypt", "Invalid"]
                }
              },
              "required": ["endpointUrl"]
            },
            "authentication": {
              "type": "object",
              "properties": {
                "authenticationType": {
                  "type": "string",
                  "description": "Auth mode. Defaults to ANONYMOUS when omitted. CERTIFICATE is accepted for Ignition compatibility but X.509 user-certificate auth is not implemented.",
                  "enum": ["ANONYMOUS", "USERNAME", "CERTIFICATE"]
                },
                "username": {
                  "type": "string",
                  "description": "OPC UA username, used directly when authenticationType is USERNAME. The password is resolved at runtime via internal/credentials (env var → <project>/credentials.sh → short-lived encrypted store)."
                }
              }
            }
          },
          "required": ["endpoint"]
        }
      },
      "required": ["settings"]
    },
    "diff": {
      "type": "object",
      "description": "Optional per-connection filter for diff noise. Applied by the web UI's /diff page and by `twin baseline diff` (unless --no-ignore).",
      "properties": {
        "useBuiltinDefaults": {
          "type": "boolean",
          "description": "Apply the built-in ignore list (Server.ServerDiagnostics, i=2274) on top of ignore. Defaults to true when omitted."
        },
        "ignore": {
          "type": "object",
          "properties": {
            "subtrees": {
              "type": "array",
              "items": { "type": "string" },
              "description": "NodeIDs ignored together with all their descendants."
            },
            "nodes": {
              "type": "array",
              "items": { "type": "string" },
              "description": "Individual NodeIDs ignored without affecting descendants."
            },
            "patterns": {
              "type": "array",
              "items": { "type": "string" },
              "description": "Case-insensitive substrings matched against a node's BrowseName or DisplayName."
            }
          }
        }
      }
    }
  },
  "required": ["config"]
}