{ "$defs": { "BuildMacPkg": { "additionalProperties": false, "properties": { "apiVersion": { "const": "stemma/v1alpha1" }, "kind": { "const": "BuildMacPkg" }, "metadata": { "additionalProperties": false, "properties": { "name": { "pattern": "^[A-Za-z0-9][A-Za-z0-9._-]{0,127}$", "type": "string" } }, "required": [ "name" ], "type": "object" }, "profiles": { "description": "Name the opt-in workloads the resource belongs to. Runs take it only when they select one of these profiles, name it, or select a resource consuming its outputs. It still validates and keeps its reviewed lock entries.", "items": { "pattern": "^[A-Za-z0-9][A-Za-z0-9._-]{0,127}$", "type": "string" }, "type": "array", "uniqueItems": true }, "spec": { "anyOf": [ { "$id": "https://stemma.invalid/editor/resource/stemma%2Fv1alpha1%2FBuildMacPkg/complete", "$schema": "https://json-schema.org/draft/2020-12/schema", "additionalProperties": false, "properties": { "inputs": { "anyOf": [ { "additionalProperties": { "$ref": "https://stemma.invalid/catalog.schema.json#/$defs/Input" }, "propertyNames": { "not": { "pattern": "\\{\\{" } }, "type": "object" }, { "pattern": "^\\{\\{[\\s\\S]+\\}\\}$", "type": "string" } ], "description": "Named source artifacts leased into the build. Refer to them with $input in payload and scripts." }, "package": { "anyOf": [ { "additionalProperties": false, "properties": { "compression": { "anyOf": [ { "enum": [ "gzip", "xz" ], "type": "string" }, { "pattern": "\\{\\{[\\s\\S]+\\}\\}", "type": "string" } ], "description": "Payload compression: gzip or xz. Omit for gzip. xz builds a smaller package, costs far more CPU to build and read, and installs on macOS 10.10 or later." }, "filename": { "anyOf": [ { "type": "string" }, { "pattern": "\\{\\{[\\s\\S]+\\}\\}", "type": "string" } ], "description": "Optional published PKG basename. Omit to derive it from the resource name and package version." }, "identifier": { "anyOf": [ { "type": "string" }, { "pattern": "\\{\\{[\\s\\S]+\\}\\}", "type": "string" } ], "description": "Stable reverse-DNS package identifier written into the installation receipt." }, "version": { "anyOf": [ { "type": "string" }, { "pattern": "\\{\\{[\\s\\S]+\\}\\}", "type": "string" } ], "description": "Package receipt version. Change it when the managed payload changes." } }, "propertyNames": { "not": { "pattern": "\\{\\{" } }, "required": [ "identifier", "version" ], "type": "object" }, { "pattern": "^\\{\\{[\\s\\S]+\\}\\}$", "type": "string" } ], "description": "Component package identity and version recorded in macOS receipts, with the published filename and payload compression." }, "payload": { "anyOf": [ { "additionalProperties": { "anyOf": [ { "additionalProperties": false, "properties": { "$input": { "description": "Name of a declared input supplying this file or tree.", "not": { "pattern": "\\{\\{" }, "type": "string" }, "content": { "anyOf": [ { "type": "string" }, { "pattern": "\\{\\{[\\s\\S]+\\}\\}", "type": "string" } ], "description": "Literal UTF-8 file contents. Mutually exclusive with $input; omit both to create a directory." }, "gid": { "anyOf": [ { "maximum": 262143, "type": "integer" }, { "pattern": "^\\{\\{[\\s\\S]+\\}\\}$", "type": "string" } ], "description": "Numeric group applied to the mapped subtree. Defaults to wheel (0)." }, "mode": { "anyOf": [ { "pattern": "^0?[0-7]{3}$", "type": "string" }, { "pattern": "\\{\\{[\\s\\S]+\\}\\}", "type": "string" } ], "description": "Octal permissions for the mapped root, for example 0644 for a file or 0755 for a directory." }, "path": { "anyOf": [ { "type": "string" }, { "pattern": "\\{\\{[\\s\\S]+\\}\\}", "type": "string" } ], "description": "Exact relative path in a tree, ZIP, TAR or DMG. A dot selects the contents root. Omit to retain the original input; PKGs remain opaque files." }, "symlink": { "anyOf": [ { "type": "string" }, { "pattern": "\\{\\{[\\s\\S]+\\}\\}", "type": "string" } ], "description": "Relative link target in the installed filesystem, confined to the package root. Mutually exclusive with $input and content." }, "uid": { "anyOf": [ { "maximum": 262143, "type": "integer" }, { "pattern": "^\\{\\{[\\s\\S]+\\}\\}$", "type": "string" } ], "description": "Numeric owner applied to the mapped subtree. Defaults to root (0)." } }, "propertyNames": { "not": { "pattern": "\\{\\{" } }, "type": "object" }, { "pattern": "^\\{\\{[\\s\\S]+\\}\\}$", "type": "string" } ] }, "propertyNames": { "not": { "pattern": "\\{\\{" } }, "type": "object" }, { "pattern": "^\\{\\{[\\s\\S]+\\}\\}$", "type": "string" } ], "description": "Installed absolute paths mapped to files, trees, literal text, relative symlinks or directory declarations. Omit or use {} for an empty payload; every built package leaves a receipt after successful installation." }, "scripts": { "anyOf": [ { "additionalProperties": { "anyOf": [ { "oneOf": [ { "type": "string" }, { "additionalProperties": false, "properties": { "$input": { "description": "Declared input supplying the script or resource.", "minLength": 1, "not": { "pattern": "\\{\\{" }, "type": "string" }, "path": { "anyOf": [ { "type": "string" }, { "pattern": "\\{\\{[\\s\\S]+\\}\\}", "type": "string" } ], "description": "Exact path within a tree, ZIP, TAR or DMG. A dot selects the contents root. Omit to use the original input." } }, "propertyNames": { "not": { "pattern": "\\{\\{" } }, "required": [ "$input" ], "type": "object" } ] }, { "pattern": "^\\{\\{[\\s\\S]+\\}\\}$", "type": "string" } ] }, "propertyNames": { "not": { "pattern": "\\{\\{" } }, "type": "object" }, { "pattern": "^\\{\\{[\\s\\S]+\\}\\}$", "type": "string" } ], "description": "Literal script text or input selections in the temporary installer Scripts area. Root preinstall and postinstall files are hooks; other entries are resources used by those hooks. Never executed by Stemma." }, "signatures": { "anyOf": [ { "items": { "anyOf": [ { "additionalProperties": false, "oneOf": [ { "required": [ "signer" ] }, { "required": [ "unsigned" ] } ], "properties": { "input": { "anyOf": [ { "minLength": 1, "type": "string" }, { "pattern": "\\{\\{[\\s\\S]+\\}\\}", "type": "string" } ], "description": "Declared input whose selected content the build consumes." }, "signer": { "anyOf": [ { "minLength": 1, "type": "string" }, { "pattern": "\\{\\{[\\s\\S]+\\}\\}", "type": "string" } ], "description": "Expected publisher: apple:developer-id:\u003cTEAMID\u003e, apple:app-store:\u003cTEAMID\u003e or authenticode:\u003cSHA256\u003e. Mutually exclusive with unsigned." }, "subject": { "anyOf": [ { "additionalProperties": false, "minProperties": 1, "properties": { "bundle_id": { "anyOf": [ { "type": "string" }, { "pattern": "\\{\\{[\\s\\S]+\\}\\}", "type": "string" } ], "description": "Application bundle identifier, combined with any supplied path selectors." }, "installed_path": { "anyOf": [ { "type": "string" }, { "pattern": "\\{\\{[\\s\\S]+\\}\\}", "type": "string" } ], "description": "Observed absolute installation path, when the installer declares one." }, "kind": { "anyOf": [ { "type": "string" }, { "pattern": "\\{\\{[\\s\\S]+\\}\\}", "type": "string" } ], "description": "Observed subject kind, such as app, container, file, package or msi. A package subject describes a receipt; the outer PKG is a container." }, "package_id": { "anyOf": [ { "type": "string" }, { "pattern": "\\{\\{[\\s\\S]+\\}\\}", "type": "string" } ], "description": "Package identifier of a component receipt, as macOS records it." }, "path": { "anyOf": [ { "type": "string" }, { "pattern": "\\{\\{[\\s\\S]+\\}\\}", "type": "string" } ], "description": "Exact path within the inspected artifact. A dot selects the artifact root." } }, "propertyNames": { "not": { "pattern": "\\{\\{" } }, "type": "object" }, { "pattern": "^\\{\\{[\\s\\S]+\\}\\}$", "type": "string" } ], "description": "One physical signing subject. Omit it where there is only one, such as the PKG itself or the only application in an image. Component receipts do not carry the outer PKG signature." }, "unsigned": { "anyOf": [ { "enum": [ true ], "type": "boolean" }, { "pattern": "^\\{\\{[\\s\\S]+\\}\\}$", "type": "string" } ], "description": "Assert that the subject has no signature. A signed, invalid or unsupported signature fails this assertion." } }, "propertyNames": { "not": { "pattern": "\\{\\{" } }, "required": [ "input" ], "type": "object" }, { "pattern": "^\\{\\{[\\s\\S]+\\}\\}$", "type": "string" } ] }, "minItems": 1, "type": "array" }, { "pattern": "^\\{\\{[\\s\\S]+\\}\\}$", "type": "string" } ], "description": "Signing expectations for every physical signing subject consumed by the resolved payload and scripts layout. Unused siblings are excluded, and a package another build produced needs none. The built package itself is unsigned." } }, "propertyNames": { "not": { "pattern": "\\{\\{" } }, "required": [ "package" ], "type": "object" }, { "allOf": [ { "$id": "https://stemma.invalid/editor/resource/stemma%2Fv1alpha1%2FBuildMacPkg/partial", "$schema": "https://json-schema.org/draft/2020-12/schema", "additionalProperties": false, "properties": { "extends": { "pattern": "^[A-Za-z0-9][A-Za-z0-9._-]{0,127}$", "type": "string" }, "inputs": { "anyOf": [ { "additionalProperties": { "$ref": "https://stemma.invalid/catalog.schema.json#/$defs/PartialInput" }, "propertyNames": { "not": { "pattern": "\\{\\{" } }, "type": "object" }, { "pattern": "^\\{\\{[\\s\\S]+\\}\\}$", "type": "string" } ], "description": "Named source artifacts leased into the build. Refer to them with $input in payload and scripts." }, "package": { "anyOf": [ { "additionalProperties": false, "properties": { "compression": { "anyOf": [ { "enum": [ "gzip", "xz" ], "type": "string" }, { "pattern": "\\{\\{[\\s\\S]+\\}\\}", "type": "string" } ], "description": "Payload compression: gzip or xz. Omit for gzip. xz builds a smaller package, costs far more CPU to build and read, and installs on macOS 10.10 or later." }, "filename": { "anyOf": [ { "type": "string" }, { "pattern": "\\{\\{[\\s\\S]+\\}\\}", "type": "string" } ], "description": "Optional published PKG basename. Omit to derive it from the resource name and package version." }, "identifier": { "anyOf": [ { "type": "string" }, { "pattern": "\\{\\{[\\s\\S]+\\}\\}", "type": "string" } ], "description": "Stable reverse-DNS package identifier written into the installation receipt." }, "version": { "anyOf": [ { "type": "string" }, { "pattern": "\\{\\{[\\s\\S]+\\}\\}", "type": "string" } ], "description": "Package receipt version. Change it when the managed payload changes." } }, "propertyNames": { "not": { "pattern": "\\{\\{" } }, "type": "object" }, { "pattern": "^\\{\\{[\\s\\S]+\\}\\}$", "type": "string" } ], "description": "Component package identity and version recorded in macOS receipts, with the published filename and payload compression." }, "payload": { "anyOf": [ { "additionalProperties": { "anyOf": [ { "additionalProperties": false, "properties": { "$input": { "description": "Name of a declared input supplying this file or tree.", "not": { "pattern": "\\{\\{" }, "type": "string" }, "content": { "anyOf": [ { "type": "string" }, { "pattern": "\\{\\{[\\s\\S]+\\}\\}", "type": "string" } ], "description": "Literal UTF-8 file contents. Mutually exclusive with $input; omit both to create a directory." }, "gid": { "anyOf": [ { "maximum": 262143, "type": "integer" }, { "pattern": "^\\{\\{[\\s\\S]+\\}\\}$", "type": "string" } ], "description": "Numeric group applied to the mapped subtree. Defaults to wheel (0)." }, "mode": { "anyOf": [ { "pattern": "^0?[0-7]{3}$", "type": "string" }, { "pattern": "\\{\\{[\\s\\S]+\\}\\}", "type": "string" } ], "description": "Octal permissions for the mapped root, for example 0644 for a file or 0755 for a directory." }, "path": { "anyOf": [ { "type": "string" }, { "pattern": "\\{\\{[\\s\\S]+\\}\\}", "type": "string" } ], "description": "Exact relative path in a tree, ZIP, TAR or DMG. A dot selects the contents root. Omit to retain the original input; PKGs remain opaque files." }, "symlink": { "anyOf": [ { "type": "string" }, { "pattern": "\\{\\{[\\s\\S]+\\}\\}", "type": "string" } ], "description": "Relative link target in the installed filesystem, confined to the package root. Mutually exclusive with $input and content." }, "uid": { "anyOf": [ { "maximum": 262143, "type": "integer" }, { "pattern": "^\\{\\{[\\s\\S]+\\}\\}$", "type": "string" } ], "description": "Numeric owner applied to the mapped subtree. Defaults to root (0)." } }, "propertyNames": { "not": { "pattern": "\\{\\{" } }, "type": "object" }, { "pattern": "^\\{\\{[\\s\\S]+\\}\\}$", "type": "string" } ] }, "propertyNames": { "not": { "pattern": "\\{\\{" } }, "type": "object" }, { "pattern": "^\\{\\{[\\s\\S]+\\}\\}$", "type": "string" } ], "description": "Installed absolute paths mapped to files, trees, literal text, relative symlinks or directory declarations. Omit or use {} for an empty payload; every built package leaves a receipt after successful installation." }, "scripts": { "anyOf": [ { "additionalProperties": { "anyOf": [ { "allOf": [ { "anyOf": [ { "type": "string" }, { "additionalProperties": false, "properties": { "$input": { "description": "Declared input supplying the script or resource.", "minLength": 1, "not": { "pattern": "\\{\\{" }, "type": "string" }, "path": { "anyOf": [ { "type": "string" }, { "pattern": "\\{\\{[\\s\\S]+\\}\\}", "type": "string" } ], "description": "Exact path within a tree, ZIP, TAR or DMG. A dot selects the contents root. Omit to use the original input." } }, "propertyNames": { "not": { "pattern": "\\{\\{" } }, "type": "object" } ] } ] }, { "pattern": "^\\{\\{[\\s\\S]+\\}\\}$", "type": "string" } ] }, "propertyNames": { "not": { "pattern": "\\{\\{" } }, "type": "object" }, { "pattern": "^\\{\\{[\\s\\S]+\\}\\}$", "type": "string" } ], "description": "Literal script text or input selections in the temporary installer Scripts area. Root preinstall and postinstall files are hooks; other entries are resources used by those hooks. Never executed by Stemma." }, "signatures": { "anyOf": [ { "items": { "anyOf": [ { "additionalProperties": false, "allOf": [ { "anyOf": [ {}, {} ] } ], "properties": { "input": { "anyOf": [ { "minLength": 1, "type": "string" }, { "pattern": "\\{\\{[\\s\\S]+\\}\\}", "type": "string" } ], "description": "Declared input whose selected content the build consumes." }, "signer": { "anyOf": [ { "minLength": 1, "type": "string" }, { "pattern": "\\{\\{[\\s\\S]+\\}\\}", "type": "string" } ], "description": "Expected publisher: apple:developer-id:\u003cTEAMID\u003e, apple:app-store:\u003cTEAMID\u003e or authenticode:\u003cSHA256\u003e. Mutually exclusive with unsigned." }, "subject": { "anyOf": [ { "additionalProperties": false, "minProperties": 1, "properties": { "bundle_id": { "anyOf": [ { "type": "string" }, { "pattern": "\\{\\{[\\s\\S]+\\}\\}", "type": "string" } ], "description": "Application bundle identifier, combined with any supplied path selectors." }, "installed_path": { "anyOf": [ { "type": "string" }, { "pattern": "\\{\\{[\\s\\S]+\\}\\}", "type": "string" } ], "description": "Observed absolute installation path, when the installer declares one." }, "kind": { "anyOf": [ { "type": "string" }, { "pattern": "\\{\\{[\\s\\S]+\\}\\}", "type": "string" } ], "description": "Observed subject kind, such as app, container, file, package or msi. A package subject describes a receipt; the outer PKG is a container." }, "package_id": { "anyOf": [ { "type": "string" }, { "pattern": "\\{\\{[\\s\\S]+\\}\\}", "type": "string" } ], "description": "Package identifier of a component receipt, as macOS records it." }, "path": { "anyOf": [ { "type": "string" }, { "pattern": "\\{\\{[\\s\\S]+\\}\\}", "type": "string" } ], "description": "Exact path within the inspected artifact. A dot selects the artifact root." } }, "propertyNames": { "not": { "pattern": "\\{\\{" } }, "type": "object" }, { "pattern": "^\\{\\{[\\s\\S]+\\}\\}$", "type": "string" } ], "description": "One physical signing subject. Omit it where there is only one, such as the PKG itself or the only application in an image. Component receipts do not carry the outer PKG signature." }, "unsigned": { "anyOf": [ { "enum": [ true ], "type": "boolean" }, { "pattern": "^\\{\\{[\\s\\S]+\\}\\}$", "type": "string" } ], "description": "Assert that the subject has no signature. A signed, invalid or unsupported signature fails this assertion." } }, "propertyNames": { "not": { "pattern": "\\{\\{" } }, "type": "object" }, { "pattern": "^\\{\\{[\\s\\S]+\\}\\}$", "type": "string" } ] }, "minItems": 1, "type": "array" }, { "pattern": "^\\{\\{[\\s\\S]+\\}\\}$", "type": "string" } ], "description": "Signing expectations for every physical signing subject consumed by the resolved payload and scripts layout. Unused siblings are excluded, and a package another build produced needs none. The built package itself is unsigned." } }, "propertyNames": { "not": { "pattern": "\\{\\{" } }, "type": "object" }, { "required": [ "extends" ] } ] } ] }, "suspend": { "description": "Keep the resource out of every run that does not name it, whatever profiles the run selects. It still validates and keeps its reviewed lock entries; naming it, or a suspended resource consuming its outputs, runs it.", "type": "boolean" } }, "required": [ "apiVersion", "kind", "metadata", "spec" ], "type": "object" }, "Destination": { "additionalProperties": false, "properties": { "config": { "anyOf": [ { "propertyNames": { "not": { "pattern": "\\{\\{" } }, "type": "object" }, { "pattern": "^\\{\\{[\\s\\S]+\\}\\}$", "type": "string" } ], "description": "Destination-specific connection configuration. Reference credential environment variables instead of embedding secrets." }, "operation": { "description": "Registered destination operation, such as munki, intune or jamf. Executable plugins register their own operation names.", "type": "string" } }, "required": [ "operation" ], "type": "object" }, "Input": { "oneOf": [ { "additionalProperties": false, "properties": { "resource": { "additionalProperties": false, "description": "Use a named output from another resource in this project.", "properties": { "apiVersion": { "default": "stemma/v1alpha1", "not": { "pattern": "\\{\\{" }, "type": "string" }, "kind": { "minLength": 1, "not": { "pattern": "\\{\\{" }, "type": "string" }, "name": { "minLength": 1, "not": { "pattern": "\\{\\{" }, "type": "string" }, "output": { "default": "installer", "not": { "pattern": "\\{\\{" }, "type": "string" } }, "required": [ "kind", "name" ], "type": "object" } }, "required": [ "resource" ], "type": "object" }, { "additionalProperties": false, "properties": { "filename": { "anyOf": [ { "type": "string" }, { "pattern": "\\{\\{[\\s\\S]+\\}\\}", "type": "string" } ], "description": "Optional input basename override. Defaults to the selected path's basename. Independent of publication naming." }, "path": { "anyOf": [ { "minLength": 1, "type": "string" }, { "pattern": "\\{\\{[\\s\\S]+\\}\\}", "type": "string" } ], "description": "Exact file or directory path. Relative paths resolve from the resource file; absolute paths select a host location." }, "sha256": { "anyOf": [ { "type": "string" }, { "pattern": "\\{\\{[\\s\\S]+\\}\\}", "type": "string" } ], "description": "Optional expected SHA-256 content digest, as 64 lowercase hexadecimal characters." } }, "propertyNames": { "not": { "pattern": "\\{\\{" } }, "required": [ "path" ], "type": "object" }, { "additionalProperties": false, "properties": { "filename": { "anyOf": [ { "type": "string" }, { "pattern": "\\{\\{[\\s\\S]+\\}\\}", "type": "string" } ], "description": "Optional input basename override. Defaults to the selected path's basename. Independent of publication naming." }, "path": { "anyOf": [ { "minLength": 1, "type": "string" }, { "pattern": "\\{\\{[\\s\\S]+\\}\\}", "type": "string" } ], "description": "Exact file or directory path. Relative paths resolve from the resource file; absolute paths select a host location." }, "resolver": { "const": "file", "description": "Built-in resolver selecting this input." }, "sha256": { "anyOf": [ { "type": "string" }, { "pattern": "\\{\\{[\\s\\S]+\\}\\}", "type": "string" } ], "description": "Optional expected SHA-256 content digest, as 64 lowercase hexadecimal characters." } }, "propertyNames": { "not": { "pattern": "\\{\\{" } }, "required": [ "path", "resolver" ], "type": "object" }, { "additionalProperties": false, "properties": { "asset": { "anyOf": [ { "minLength": 1, "type": "string" }, { "pattern": "\\{\\{[\\s\\S]+\\}\\}", "type": "string" } ], "description": "GitHub asset-name glob using doublestar semantics. Must match exactly one release asset; exact names also work." }, "filename": { "anyOf": [ { "type": "string" }, { "pattern": "\\{\\{[\\s\\S]+\\}\\}", "type": "string" } ], "description": "Optional input basename override. Defaults to the selected asset name. Independent of publication naming." }, "include_prereleases": { "anyOf": [ { "type": "boolean" }, { "pattern": "^\\{\\{[\\s\\S]+\\}\\}$", "type": "string" } ], "description": "Include prereleases when discovering latest or a tag glob; select the newest published non-draft release. Explicit release tags are unchanged." }, "release": { "anyOf": [ { "type": "string" }, { "pattern": "\\{\\{[\\s\\S]+\\}\\}", "type": "string" } ], "description": "GitHub release tag, tag glob, or latest. Omitted or empty values select latest. A value containing *, ? or [ selects the newest published release whose tag matches, using doublestar semantics." }, "repository": { "anyOf": [ { "minLength": 1, "type": "string" }, { "pattern": "\\{\\{[\\s\\S]+\\}\\}", "type": "string" } ], "description": "GitHub repository in owner/name form." }, "resolver": { "const": "github", "description": "Built-in resolver selecting this input." }, "sha256": { "anyOf": [ { "type": "string" }, { "pattern": "\\{\\{[\\s\\S]+\\}\\}", "type": "string" } ], "description": "Optional expected SHA-256 content digest, as 64 lowercase hexadecimal characters." }, "token": { "anyOf": [ { "type": "string" }, { "pattern": "\\{\\{[\\s\\S]+\\}\\}", "type": "string" } ], "description": "Optional bearer token for release discovery and acquisition. Without one, discovery uses GH_TOKEN, then GITHUB_TOKEN, from the environment.", "writeOnly": true } }, "propertyNames": { "not": { "pattern": "\\{\\{" } }, "required": [ "repository", "asset", "resolver" ], "type": "object" }, { "additionalProperties": false, "oneOf": [ { "not": { "required": [ "formula" ] }, "required": [ "cask" ] }, { "not": { "required": [ "cask" ] }, "required": [ "formula" ] } ], "properties": { "architecture": { "anyOf": [ { "enum": [ "arm64", "x86_64" ], "type": "string" }, { "pattern": "\\{\\{[\\s\\S]+\\}\\}", "type": "string" } ], "description": "Target architecture. Defaults to arm64, independently of the runner." }, "cask": { "anyOf": [ { "type": "string" }, { "pattern": "\\{\\{[\\s\\S]+\\}\\}", "type": "string" } ], "description": "Homebrew cask token. Selects its vendor download; no cask actions run." }, "formula": { "anyOf": [ { "type": "string" }, { "pattern": "\\{\\{[\\s\\S]+\\}\\}", "type": "string" } ], "description": "Homebrew core formula token. Selects a standalone bottle requiring no relocation, runtime formula dependencies or post-install actions. No source-build fallback." }, "language": { "anyOf": [ { "type": "string" }, { "pattern": "\\{\\{[\\s\\S]+\\}\\}", "type": "string" } ], "description": "Cask language alias. Omit for the cask's declared default language." }, "macos": { "anyOf": [ { "type": "string" }, { "pattern": "\\{\\{[\\s\\S]+\\}\\}", "type": "string" } ], "description": "Target macOS major version. Omit for the current supported release (27). Update locks the concrete target and selected variant." }, "resolver": { "const": "homebrew", "description": "Built-in resolver selecting this input." } }, "propertyNames": { "not": { "pattern": "\\{\\{" } }, "required": [ "resolver" ], "type": "object" }, { "additionalProperties": false, "properties": { "filename": { "anyOf": [ { "type": "string" }, { "pattern": "\\{\\{[\\s\\S]+\\}\\}", "type": "string" } ], "description": "Optional input basename override. Defaults to Content-Disposition, then final and original URL basenames. Independent of publication naming." }, "headers": { "anyOf": [ { "additionalProperties": { "anyOf": [ { "type": "string" }, { "pattern": "\\{\\{[\\s\\S]+\\}\\}", "type": "string" } ] }, "propertyNames": { "not": { "pattern": "\\{\\{" } }, "type": "object" }, { "pattern": "^\\{\\{[\\s\\S]+\\}\\}$", "type": "string" } ], "description": "HTTP request headers, including optional User-Agent and Referer overrides. Credentials and custom headers are confined to the source origin. Only Accept, Accept-Encoding, Accept-Language and User-Agent participate in source identity; other headers are treated as credentials." }, "match": { "anyOf": [ { "type": "string" }, { "pattern": "\\{\\{[\\s\\S]+\\}\\}", "type": "string" } ], "description": "Download page regular expression whose full matches are URL references resolved against the page's base URL. HTML pages match element attribute values; other pages match the response body. Must identify one distinct stable HTTP(S) download URL. With a named group version capturing dotted numbers, several URLs may match: the highest version selects the URL and becomes the input's version." }, "sha256": { "anyOf": [ { "type": "string" }, { "pattern": "\\{\\{[\\s\\S]+\\}\\}", "type": "string" } ], "description": "Optional expected SHA-256 content digest, as 64 lowercase hexadecimal characters." }, "token": { "anyOf": [ { "type": "string" }, { "pattern": "\\{\\{[\\s\\S]+\\}\\}", "type": "string" } ], "description": "Optional bearer token. Mutually exclusive with an Authorization header.", "writeOnly": true }, "url": { "anyOf": [ { "minLength": 1, "type": "string" }, { "pattern": "\\{\\{[\\s\\S]+\\}\\}", "type": "string" } ], "description": "Stable HTTP download URL. Redirects are followed without retaining temporary URLs in the lockfile." } }, "propertyNames": { "not": { "pattern": "\\{\\{" } }, "required": [ "url" ], "type": "object" }, { "additionalProperties": false, "properties": { "filename": { "anyOf": [ { "type": "string" }, { "pattern": "\\{\\{[\\s\\S]+\\}\\}", "type": "string" } ], "description": "Optional input basename override. Defaults to Content-Disposition, then final and original URL basenames. Independent of publication naming." }, "headers": { "anyOf": [ { "additionalProperties": { "anyOf": [ { "type": "string" }, { "pattern": "\\{\\{[\\s\\S]+\\}\\}", "type": "string" } ] }, "propertyNames": { "not": { "pattern": "\\{\\{" } }, "type": "object" }, { "pattern": "^\\{\\{[\\s\\S]+\\}\\}$", "type": "string" } ], "description": "HTTP request headers, including optional User-Agent and Referer overrides. Credentials and custom headers are confined to the source origin. Only Accept, Accept-Encoding, Accept-Language and User-Agent participate in source identity; other headers are treated as credentials." }, "match": { "anyOf": [ { "type": "string" }, { "pattern": "\\{\\{[\\s\\S]+\\}\\}", "type": "string" } ], "description": "Download page regular expression whose full matches are URL references resolved against the page's base URL. HTML pages match element attribute values; other pages match the response body. Must identify one distinct stable HTTP(S) download URL. With a named group version capturing dotted numbers, several URLs may match: the highest version selects the URL and becomes the input's version." }, "resolver": { "const": "http", "description": "Built-in resolver selecting this input." }, "sha256": { "anyOf": [ { "type": "string" }, { "pattern": "\\{\\{[\\s\\S]+\\}\\}", "type": "string" } ], "description": "Optional expected SHA-256 content digest, as 64 lowercase hexadecimal characters." }, "token": { "anyOf": [ { "type": "string" }, { "pattern": "\\{\\{[\\s\\S]+\\}\\}", "type": "string" } ], "description": "Optional bearer token. Mutually exclusive with an Authorization header.", "writeOnly": true }, "url": { "anyOf": [ { "minLength": 1, "type": "string" }, { "pattern": "\\{\\{[\\s\\S]+\\}\\}", "type": "string" } ], "description": "Stable HTTP download URL. Redirects are followed without retaining temporary URLs in the lockfile." } }, "propertyNames": { "not": { "pattern": "\\{\\{" } }, "required": [ "url", "resolver" ], "type": "object" }, { "additionalProperties": false, "properties": { "base": { "anyOf": [ { "type": "string" }, { "pattern": "\\{\\{[\\s\\S]+\\}\\}", "type": "string" } ], "description": "Local tree root, relative to the resource file. Defaults to its directory." }, "filename": { "anyOf": [ { "type": "string" }, { "pattern": "\\{\\{[\\s\\S]+\\}\\}", "type": "string" } ], "description": "Optional input basename override. Defaults to the selected base's basename. Independent of publication naming." }, "include": { "anyOf": [ { "items": { "anyOf": [ { "type": "string" }, { "pattern": "\\{\\{[\\s\\S]+\\}\\}", "type": "string" } ] }, "minItems": 1, "type": "array" }, { "pattern": "^\\{\\{[\\s\\S]+\\}\\}$", "type": "string" } ], "description": "Local tree globs using doublestar semantics. Each pattern must match at least one entry." }, "resolver": { "const": "local", "description": "Built-in resolver selecting this input." }, "sha256": { "anyOf": [ { "type": "string" }, { "pattern": "\\{\\{[\\s\\S]+\\}\\}", "type": "string" } ], "description": "Optional expected SHA-256 content digest, as 64 lowercase hexadecimal characters." } }, "propertyNames": { "not": { "pattern": "\\{\\{" } }, "required": [ "include", "resolver" ], "type": "object" }, { "additionalProperties": false, "properties": { "architecture": { "anyOf": [ { "enum": [ "x64", "x86", "arm64", "arm", "neutral" ], "type": "string" }, { "pattern": "\\{\\{[\\s\\S]+\\}\\}", "type": "string" } ], "description": "Exact target architecture. Defaults to x64 independently of the runner." }, "installer_type": { "anyOf": [ { "type": "string" }, { "pattern": "\\{\\{[\\s\\S]+\\}\\}", "type": "string" } ], "description": "Optional declared installer type filter, such as msi, wix, inno or zip." }, "locale": { "anyOf": [ { "type": "string" }, { "pattern": "\\{\\{[\\s\\S]+\\}\\}", "type": "string" } ], "description": "Optional exact installer locale filter, such as en-US. Package description locale is not an installer locale." }, "package": { "anyOf": [ { "minLength": 1, "type": "string" }, { "pattern": "\\{\\{[\\s\\S]+\\}\\}", "type": "string" } ], "description": "Exact WinGet community package identifier." }, "resolver": { "const": "winget", "description": "Built-in resolver selecting this input." }, "scope": { "anyOf": [ { "enum": [ "user", "machine" ], "type": "string" }, { "pattern": "\\{\\{[\\s\\S]+\\}\\}", "type": "string" } ], "description": "Optional declared installer scope filter. Omit only when selection is unambiguous." }, "version": { "anyOf": [ { "type": "string" }, { "pattern": "\\{\\{[\\s\\S]+\\}\\}", "type": "string" } ], "description": "Exact published version or latest (the default). Selects the release before filtering installers." } }, "propertyNames": { "not": { "pattern": "\\{\\{" } }, "required": [ "package", "resolver" ], "type": "object" } ], "type": "object" }, "MacSoftware": { "additionalProperties": false, "properties": { "apiVersion": { "const": "stemma/v1alpha1" }, "kind": { "const": "MacSoftware" }, "metadata": { "additionalProperties": false, "properties": { "name": { "pattern": "^[A-Za-z0-9][A-Za-z0-9._-]{0,127}$", "type": "string" } }, "required": [ "name" ], "type": "object" }, "profiles": { "description": "Name the opt-in workloads the resource belongs to. Runs take it only when they select one of these profiles, name it, or select a resource consuming its outputs. It still validates and keeps its reviewed lock entries.", "items": { "pattern": "^[A-Za-z0-9][A-Za-z0-9._-]{0,127}$", "type": "string" }, "type": "array", "uniqueItems": true }, "spec": { "anyOf": [ { "$id": "https://stemma.invalid/editor/resource/stemma%2Fv1alpha1%2FMacSoftware/complete", "additionalProperties": false, "properties": { "application": { "anyOf": [ { "additionalProperties": false, "properties": { "bundle_id": { "anyOf": [ { "type": "string" }, { "pattern": "\\{\\{[\\s\\S]+\\}\\}", "type": "string" } ], "description": "Bundle identifier used to select one application when an input contains several." }, "installed_path": { "anyOf": [ { "type": "string" }, { "pattern": "\\{\\{[\\s\\S]+\\}\\}", "type": "string" } ], "description": "Absolute application path on managed devices, used for packaging and detection." }, "path": { "anyOf": [ { "type": "string" }, { "pattern": "\\{\\{[\\s\\S]+\\}\\}", "type": "string" } ], "description": "Archive-relative application path or glob. Must stay inside the input." }, "version_key": { "anyOf": [ { "enum": [ "CFBundleShortVersionString", "CFBundleVersion" ], "type": "string" }, { "pattern": "\\{\\{[\\s\\S]+\\}\\}", "type": "string" } ], "description": "Info.plist key used as the managed version. Omit to prefer CFBundleShortVersionString, then CFBundleVersion." } }, "propertyNames": { "not": { "pattern": "\\{\\{" } }, "type": "object" }, { "pattern": "^\\{\\{[\\s\\S]+\\}\\}$", "type": "string" } ], "description": "Select the application that supplies version, detection and icon metadata. An archive publishes it in a new disk image; package publishes it from an archive, tree or disk image in a new PKG. Vendor packages default to installer metadata and receipts; selecting a package application requires path or bundle_id." }, "destinations": { "additionalProperties": { "anyOf": [ { "$ref": "https://stemma.invalid/editor/intune/metadata" }, { "$ref": "https://stemma.invalid/editor/jamf/metadata" }, { "$ref": "https://stemma.invalid/editor/munki/metadata" } ] }, "description": "Native metadata for each named Project destination. Explicit values override derived values.", "properties": {}, "propertyNames": { "pattern": "^[A-Za-z0-9][A-Za-z0-9._-]{0,127}$" }, "type": "object" }, "disk_image": { "anyOf": [ { "additionalProperties": false, "properties": { "compression": { "anyOf": [ { "enum": [ "lzfse", "zlib", "lzma" ], "type": "string" }, { "pattern": "\\{\\{[\\s\\S]+\\}\\}", "type": "string" } ], "description": "Chunk compression: lzfse, zlib or lzma. Omit for lzfse. lzma builds the smallest image and costs the most CPU to build and read." } }, "propertyNames": { "not": { "pattern": "\\{\\{" } }, "type": "object" }, { "pattern": "^\\{\\{[\\s\\S]+\\}\\}$", "type": "string" } ], "description": "How preparation encodes the disk image it creates for an application from an archive or tree." }, "icon": { "anyOf": [ { "maxLength": 128, "pattern": "^[A-Za-z0-9][A-Za-z0-9._-]*$", "type": "string" }, { "pattern": "\\{\\{[\\s\\S]+\\}\\}", "type": "string" } ], "description": "Name of the icon asset icons/\u003cname\u003e.png that destinations publish. Create it with stemma icon or commit a square PNG." }, "minimum_os": { "anyOf": [ { "pattern": "^[0-9]+([.][0-9]+)?([.][0-9]+)?$", "type": "string" }, { "pattern": "\\{\\{[\\s\\S]+\\}\\}", "type": "string" } ], "description": "Minimum macOS release, such as 14.0. Destinations receive this instead of the installer's and the selected application's requirements. Omit to use the latest of those." }, "package": { "anyOf": [ { "additionalProperties": false, "properties": { "compression": { "anyOf": [ { "enum": [ "gzip", "xz" ], "type": "string" }, { "pattern": "\\{\\{[\\s\\S]+\\}\\}", "type": "string" } ], "description": "Payload compression: gzip or xz. Omit for gzip. xz builds a smaller package, costs far more CPU to build and read, and installs on macOS 10.10 or later." }, "identifier": { "anyOf": [ { "maxLength": 255, "pattern": "^[A-Za-z0-9][A-Za-z0-9.-]*$", "type": "string" }, { "pattern": "\\{\\{[\\s\\S]+\\}\\}", "type": "string" } ], "description": "Package identifier written into the installation receipt. Omit to use the application's bundle identifier." } }, "propertyNames": { "not": { "pattern": "\\{\\{" } }, "type": "object" }, { "pattern": "^\\{\\{[\\s\\S]+\\}\\}$", "type": "string" } ], "description": "Publish the selected application in a new component PKG that installs it at application.installed_path, whether it came from an archive, a tree or a disk image. {} takes every default. The PKG is unsigned and has no scripts; BuildMacPkg builds any other payload. A vendor PKG is published as it is, so package does not apply to one." }, "package_path": { "anyOf": [ { "type": "string" }, { "pattern": "\\{\\{[\\s\\S]+\\}\\}", "type": "string" } ], "description": "Path or glob selecting one installer package, relative to the archive or disk image holding it. It may instead name a disk image to open. Selection must be unambiguous." }, "signatures": { "anyOf": [ { "items": { "anyOf": [ { "additionalProperties": false, "oneOf": [ { "required": [ "signer" ] }, { "required": [ "unsigned" ] } ], "properties": { "signer": { "anyOf": [ { "minLength": 1, "type": "string" }, { "pattern": "\\{\\{[\\s\\S]+\\}\\}", "type": "string" } ], "description": "Expected publisher: apple:developer-id:\u003cTEAMID\u003e, apple:app-store:\u003cTEAMID\u003e or authenticode:\u003cSHA256\u003e. Mutually exclusive with unsigned." }, "subject": { "anyOf": [ { "additionalProperties": false, "minProperties": 1, "properties": { "bundle_id": { "anyOf": [ { "type": "string" }, { "pattern": "\\{\\{[\\s\\S]+\\}\\}", "type": "string" } ], "description": "Application bundle identifier, combined with any supplied path selectors." }, "installed_path": { "anyOf": [ { "type": "string" }, { "pattern": "\\{\\{[\\s\\S]+\\}\\}", "type": "string" } ], "description": "Observed absolute installation path, when the installer declares one." }, "kind": { "anyOf": [ { "type": "string" }, { "pattern": "\\{\\{[\\s\\S]+\\}\\}", "type": "string" } ], "description": "Observed subject kind, such as app, container, file, package or msi. A package subject describes a receipt; the outer PKG is a container." }, "package_id": { "anyOf": [ { "type": "string" }, { "pattern": "\\{\\{[\\s\\S]+\\}\\}", "type": "string" } ], "description": "Package identifier of a component receipt, as macOS records it." }, "path": { "anyOf": [ { "type": "string" }, { "pattern": "\\{\\{[\\s\\S]+\\}\\}", "type": "string" } ], "description": "Exact path within the inspected artifact. A dot selects the artifact root." } }, "propertyNames": { "not": { "pattern": "\\{\\{" } }, "type": "object" }, { "pattern": "^\\{\\{[\\s\\S]+\\}\\}$", "type": "string" } ], "description": "One physical signing subject. Omit it where there is only one, such as the PKG itself or the only application in an image. Component receipts do not carry the outer PKG signature." }, "unsigned": { "anyOf": [ { "enum": [ true ], "type": "boolean" }, { "pattern": "^\\{\\{[\\s\\S]+\\}\\}$", "type": "string" } ], "description": "Assert that the subject has no signature. A signed, invalid or unsupported signature fails this assertion." } }, "propertyNames": { "not": { "pattern": "\\{\\{" } }, "type": "object" }, { "pattern": "^\\{\\{[\\s\\S]+\\}\\}$", "type": "string" } ] }, "minItems": 1, "type": "array" }, { "pattern": "^\\{\\{[\\s\\S]+\\}\\}$", "type": "string" } ], "description": "Signing expectations for the published vendor PKG, for every top-level application in the published disk image, or for the application package publishes. Omit to make no signing assertion; a package BuildMacPkg built needs none. Derive with stemma signature." }, "source": { "$ref": "https://stemma.invalid/catalog.schema.json#/$defs/Input", "description": "Installer input from a built-in or loaded resolver, or a named resource output. Omit for source-free destination policies." }, "subjects": { "anyOf": [ { "additionalProperties": { "anyOf": [ { "additionalProperties": false, "properties": { "bundle_id": { "anyOf": [ { "type": "string" }, { "pattern": "\\{\\{[\\s\\S]+\\}\\}", "type": "string" } ], "description": "Application bundle identifier, combined with any supplied path selectors." }, "installed_path": { "anyOf": [ { "type": "string" }, { "pattern": "\\{\\{[\\s\\S]+\\}\\}", "type": "string" } ], "description": "Observed absolute installation path, when the installer declares one." }, "kind": { "anyOf": [ { "type": "string" }, { "pattern": "\\{\\{[\\s\\S]+\\}\\}", "type": "string" } ], "description": "Observed subject kind, such as app, container, file, package or msi. A package subject describes a receipt; the outer PKG is a container." }, "package_id": { "anyOf": [ { "type": "string" }, { "pattern": "\\{\\{[\\s\\S]+\\}\\}", "type": "string" } ], "description": "Package identifier of a component receipt, as macOS records it." }, "path": { "anyOf": [ { "type": "string" }, { "pattern": "\\{\\{[\\s\\S]+\\}\\}", "type": "string" } ], "description": "Exact path within the inspected artifact. A dot selects the artifact root." } }, "propertyNames": { "not": { "pattern": "\\{\\{" } }, "type": "object" }, { "pattern": "^\\{\\{[\\s\\S]+\\}\\}$", "type": "string" } ] }, "propertyNames": { "not": { "pattern": "\\{\\{" } }, "type": "object" }, { "pattern": "^\\{\\{[\\s\\S]+\\}\\}$", "type": "string" } ], "description": "Named selectors exposed as facts in destination expressions. Unaliased subjects remain addressable by their observed ID." } }, "propertyNames": { "not": { "pattern": "\\{\\{" } }, "type": "object" }, { "allOf": [ { "$id": "https://stemma.invalid/editor/resource/stemma%2Fv1alpha1%2FMacSoftware/partial", "additionalProperties": false, "properties": { "application": { "anyOf": [ { "additionalProperties": false, "properties": { "bundle_id": { "anyOf": [ { "type": "string" }, { "pattern": "\\{\\{[\\s\\S]+\\}\\}", "type": "string" } ], "description": "Bundle identifier used to select one application when an input contains several." }, "installed_path": { "anyOf": [ { "type": "string" }, { "pattern": "\\{\\{[\\s\\S]+\\}\\}", "type": "string" } ], "description": "Absolute application path on managed devices, used for packaging and detection." }, "path": { "anyOf": [ { "type": "string" }, { "pattern": "\\{\\{[\\s\\S]+\\}\\}", "type": "string" } ], "description": "Archive-relative application path or glob. Must stay inside the input." }, "version_key": { "anyOf": [ { "enum": [ "CFBundleShortVersionString", "CFBundleVersion" ], "type": "string" }, { "pattern": "\\{\\{[\\s\\S]+\\}\\}", "type": "string" } ], "description": "Info.plist key used as the managed version. Omit to prefer CFBundleShortVersionString, then CFBundleVersion." } }, "propertyNames": { "not": { "pattern": "\\{\\{" } }, "type": "object" }, { "pattern": "^\\{\\{[\\s\\S]+\\}\\}$", "type": "string" } ], "description": "Select the application that supplies version, detection and icon metadata. An archive publishes it in a new disk image; package publishes it from an archive, tree or disk image in a new PKG. Vendor packages default to installer metadata and receipts; selecting a package application requires path or bundle_id." }, "destinations": { "additionalProperties": { "anyOf": [ { "$ref": "https://stemma.invalid/editor/intune/metadata" }, { "$ref": "https://stemma.invalid/editor/jamf/metadata" }, { "$ref": "https://stemma.invalid/editor/munki/metadata" } ] }, "description": "Native metadata for each named Project destination. Explicit values override derived values.", "properties": {}, "propertyNames": { "pattern": "^[A-Za-z0-9][A-Za-z0-9._-]{0,127}$" }, "type": "object" }, "disk_image": { "anyOf": [ { "additionalProperties": false, "properties": { "compression": { "anyOf": [ { "enum": [ "lzfse", "zlib", "lzma" ], "type": "string" }, { "pattern": "\\{\\{[\\s\\S]+\\}\\}", "type": "string" } ], "description": "Chunk compression: lzfse, zlib or lzma. Omit for lzfse. lzma builds the smallest image and costs the most CPU to build and read." } }, "propertyNames": { "not": { "pattern": "\\{\\{" } }, "type": "object" }, { "pattern": "^\\{\\{[\\s\\S]+\\}\\}$", "type": "string" } ], "description": "How preparation encodes the disk image it creates for an application from an archive or tree." }, "extends": { "pattern": "^[A-Za-z0-9][A-Za-z0-9._-]{0,127}$", "type": "string" }, "icon": { "anyOf": [ { "maxLength": 128, "pattern": "^[A-Za-z0-9][A-Za-z0-9._-]*$", "type": "string" }, { "pattern": "\\{\\{[\\s\\S]+\\}\\}", "type": "string" } ], "description": "Name of the icon asset icons/\u003cname\u003e.png that destinations publish. Create it with stemma icon or commit a square PNG." }, "minimum_os": { "anyOf": [ { "pattern": "^[0-9]+([.][0-9]+)?([.][0-9]+)?$", "type": "string" }, { "pattern": "\\{\\{[\\s\\S]+\\}\\}", "type": "string" } ], "description": "Minimum macOS release, such as 14.0. Destinations receive this instead of the installer's and the selected application's requirements. Omit to use the latest of those." }, "package": { "anyOf": [ { "additionalProperties": false, "properties": { "compression": { "anyOf": [ { "enum": [ "gzip", "xz" ], "type": "string" }, { "pattern": "\\{\\{[\\s\\S]+\\}\\}", "type": "string" } ], "description": "Payload compression: gzip or xz. Omit for gzip. xz builds a smaller package, costs far more CPU to build and read, and installs on macOS 10.10 or later." }, "identifier": { "anyOf": [ { "maxLength": 255, "pattern": "^[A-Za-z0-9][A-Za-z0-9.-]*$", "type": "string" }, { "pattern": "\\{\\{[\\s\\S]+\\}\\}", "type": "string" } ], "description": "Package identifier written into the installation receipt. Omit to use the application's bundle identifier." } }, "propertyNames": { "not": { "pattern": "\\{\\{" } }, "type": "object" }, { "pattern": "^\\{\\{[\\s\\S]+\\}\\}$", "type": "string" } ], "description": "Publish the selected application in a new component PKG that installs it at application.installed_path, whether it came from an archive, a tree or a disk image. {} takes every default. The PKG is unsigned and has no scripts; BuildMacPkg builds any other payload. A vendor PKG is published as it is, so package does not apply to one." }, "package_path": { "anyOf": [ { "type": "string" }, { "pattern": "\\{\\{[\\s\\S]+\\}\\}", "type": "string" } ], "description": "Path or glob selecting one installer package, relative to the archive or disk image holding it. It may instead name a disk image to open. Selection must be unambiguous." }, "signatures": { "anyOf": [ { "items": { "anyOf": [ { "additionalProperties": false, "allOf": [ { "anyOf": [ {}, {} ] } ], "properties": { "signer": { "anyOf": [ { "minLength": 1, "type": "string" }, { "pattern": "\\{\\{[\\s\\S]+\\}\\}", "type": "string" } ], "description": "Expected publisher: apple:developer-id:\u003cTEAMID\u003e, apple:app-store:\u003cTEAMID\u003e or authenticode:\u003cSHA256\u003e. Mutually exclusive with unsigned." }, "subject": { "anyOf": [ { "additionalProperties": false, "minProperties": 1, "properties": { "bundle_id": { "anyOf": [ { "type": "string" }, { "pattern": "\\{\\{[\\s\\S]+\\}\\}", "type": "string" } ], "description": "Application bundle identifier, combined with any supplied path selectors." }, "installed_path": { "anyOf": [ { "type": "string" }, { "pattern": "\\{\\{[\\s\\S]+\\}\\}", "type": "string" } ], "description": "Observed absolute installation path, when the installer declares one." }, "kind": { "anyOf": [ { "type": "string" }, { "pattern": "\\{\\{[\\s\\S]+\\}\\}", "type": "string" } ], "description": "Observed subject kind, such as app, container, file, package or msi. A package subject describes a receipt; the outer PKG is a container." }, "package_id": { "anyOf": [ { "type": "string" }, { "pattern": "\\{\\{[\\s\\S]+\\}\\}", "type": "string" } ], "description": "Package identifier of a component receipt, as macOS records it." }, "path": { "anyOf": [ { "type": "string" }, { "pattern": "\\{\\{[\\s\\S]+\\}\\}", "type": "string" } ], "description": "Exact path within the inspected artifact. A dot selects the artifact root." } }, "propertyNames": { "not": { "pattern": "\\{\\{" } }, "type": "object" }, { "pattern": "^\\{\\{[\\s\\S]+\\}\\}$", "type": "string" } ], "description": "One physical signing subject. Omit it where there is only one, such as the PKG itself or the only application in an image. Component receipts do not carry the outer PKG signature." }, "unsigned": { "anyOf": [ { "enum": [ true ], "type": "boolean" }, { "pattern": "^\\{\\{[\\s\\S]+\\}\\}$", "type": "string" } ], "description": "Assert that the subject has no signature. A signed, invalid or unsupported signature fails this assertion." } }, "propertyNames": { "not": { "pattern": "\\{\\{" } }, "type": "object" }, { "pattern": "^\\{\\{[\\s\\S]+\\}\\}$", "type": "string" } ] }, "minItems": 1, "type": "array" }, { "pattern": "^\\{\\{[\\s\\S]+\\}\\}$", "type": "string" } ], "description": "Signing expectations for the published vendor PKG, for every top-level application in the published disk image, or for the application package publishes. Omit to make no signing assertion; a package BuildMacPkg built needs none. Derive with stemma signature." }, "source": { "$ref": "https://stemma.invalid/catalog.schema.json#/$defs/PartialInput", "description": "Installer input from a built-in or loaded resolver, or a named resource output. Omit for source-free destination policies." }, "subjects": { "anyOf": [ { "additionalProperties": { "anyOf": [ { "additionalProperties": false, "properties": { "bundle_id": { "anyOf": [ { "type": "string" }, { "pattern": "\\{\\{[\\s\\S]+\\}\\}", "type": "string" } ], "description": "Application bundle identifier, combined with any supplied path selectors." }, "installed_path": { "anyOf": [ { "type": "string" }, { "pattern": "\\{\\{[\\s\\S]+\\}\\}", "type": "string" } ], "description": "Observed absolute installation path, when the installer declares one." }, "kind": { "anyOf": [ { "type": "string" }, { "pattern": "\\{\\{[\\s\\S]+\\}\\}", "type": "string" } ], "description": "Observed subject kind, such as app, container, file, package or msi. A package subject describes a receipt; the outer PKG is a container." }, "package_id": { "anyOf": [ { "type": "string" }, { "pattern": "\\{\\{[\\s\\S]+\\}\\}", "type": "string" } ], "description": "Package identifier of a component receipt, as macOS records it." }, "path": { "anyOf": [ { "type": "string" }, { "pattern": "\\{\\{[\\s\\S]+\\}\\}", "type": "string" } ], "description": "Exact path within the inspected artifact. A dot selects the artifact root." } }, "propertyNames": { "not": { "pattern": "\\{\\{" } }, "type": "object" }, { "pattern": "^\\{\\{[\\s\\S]+\\}\\}$", "type": "string" } ] }, "propertyNames": { "not": { "pattern": "\\{\\{" } }, "type": "object" }, { "pattern": "^\\{\\{[\\s\\S]+\\}\\}$", "type": "string" } ], "description": "Named selectors exposed as facts in destination expressions. Unaliased subjects remain addressable by their observed ID." } }, "propertyNames": { "not": { "pattern": "\\{\\{" } }, "type": "object" }, { "required": [ "extends" ] } ] } ] }, "suspend": { "description": "Keep the resource out of every run that does not name it, whatever profiles the run selects. It still validates and keeps its reviewed lock entries; naming it, or a suspended resource consuming its outputs, runs it.", "type": "boolean" } }, "required": [ "apiVersion", "kind", "metadata", "spec" ], "type": "object" }, "Metadata": { "additionalProperties": false, "properties": { "name": { "description": "Literal stable identity within the project, independent of the runner environment. Renaming a file does not rename its software or destination bindings.", "pattern": "^[A-Za-z0-9][A-Za-z0-9._-]{0,127}$", "type": "string" } }, "required": [ "name" ], "type": "object" }, "OperationConfig_intune": { "$id": "https://stemma.invalid/editor/intune/config", "additionalProperties": false, "oneOf": [ { "not": { "anyOf": [ { "required": [ "tenant_id" ] }, { "required": [ "client_id" ] }, { "required": [ "client_secret" ] } ] }, "required": [ "token" ] }, { "not": { "required": [ "token" ] }, "required": [ "tenant_id", "client_id", "client_secret" ] } ], "properties": { "client_id": { "anyOf": [ { "minLength": 1, "type": "string" }, { "pattern": "\\{\\{[\\s\\S]+\\}\\}", "type": "string" } ], "description": "App registration client ID for client-credential authentication." }, "client_secret": { "anyOf": [ { "minLength": 1, "type": "string" }, { "pattern": "\\{\\{[\\s\\S]+\\}\\}", "type": "string" } ], "description": "App registration secret. Supply it through an environment reference.", "writeOnly": true }, "graph_url": { "anyOf": [ { "type": "string" }, { "pattern": "\\{\\{[\\s\\S]+\\}\\}", "type": "string" } ], "default": "https://graph.microsoft.com", "description": "Graph service origin. HTTPS is required; app management uses the beta API." }, "tenant_id": { "anyOf": [ { "minLength": 1, "type": "string" }, { "pattern": "\\{\\{[\\s\\S]+\\}\\}", "type": "string" } ], "description": "Microsoft Entra tenant ID for client-credential authentication." }, "token": { "anyOf": [ { "minLength": 1, "type": "string" }, { "pattern": "\\{\\{[\\s\\S]+\\}\\}", "type": "string" } ], "description": "Bearer token. Choose this or all three client credentials; supply secrets through environment references.", "writeOnly": true } }, "propertyNames": { "not": { "pattern": "\\{\\{" } }, "type": "object" }, "OperationConfig_jamf": { "$id": "https://stemma.invalid/editor/jamf/config", "additionalProperties": false, "properties": { "client_id": { "anyOf": [ { "minLength": 1, "type": "string" }, { "pattern": "\\{\\{[\\s\\S]+\\}\\}", "type": "string" } ], "description": "Jamf API client ID. Use an env expression to supply it from the environment." }, "client_secret": { "anyOf": [ { "minLength": 1, "type": "string" }, { "pattern": "\\{\\{[\\s\\S]+\\}\\}", "type": "string" } ], "description": "Jamf API client secret. Use an env expression to supply it from the environment.", "writeOnly": true }, "url": { "anyOf": [ { "minLength": 1, "type": "string" }, { "pattern": "\\{\\{[\\s\\S]+\\}\\}", "type": "string" } ], "description": "Jamf Pro server origin, such as https://school.jamfcloud.com. HTTPS is required except loopback test servers. Paths, embedded credentials, queries and fragments are rejected." } }, "propertyNames": { "not": { "pattern": "\\{\\{" } }, "required": [ "url", "client_id", "client_secret" ], "type": "object" }, "OperationConfig_munki": { "$id": "https://stemma.invalid/editor/munki/config", "additionalProperties": false, "properties": { "path": { "anyOf": [ { "minLength": 1, "type": "string" }, { "pattern": "\\{\\{[\\s\\S]+\\}\\}", "type": "string" } ], "description": "Repository directory, relative to the project root or absolute. Apply serializes writers and updates native catalogs." } }, "propertyNames": { "not": { "pattern": "\\{\\{" } }, "required": [ "path" ], "type": "object" }, "OperationMetadata_intune": { "$id": "https://stemma.invalid/editor/intune/metadata", "anyOf": [ { "additionalProperties": false, "not": { "required": [ "install_command", "msi_properties" ] }, "properties": { "app_id": { "anyOf": [ { "minLength": 1, "type": "string" }, { "pattern": "\\{\\{[\\s\\S]+\\}\\}", "type": "string" } ], "description": "Pin this software to an existing Intune app, which must exist and must not carry another software's identity marker. Omit to find the app by the identity marker in its notes, or create one." }, "architectures": { "anyOf": [ { "anyOf": [ { "items": { "anyOf": [ { "enum": [ "x86", "x64", "arm64" ] }, { "pattern": "^\\{\\{[\\s\\S]+\\}\\}$", "type": "string" } ] }, "minItems": 1, "type": "array", "uniqueItems": true }, { "type": "null" } ] }, { "pattern": "^\\{\\{[\\s\\S]+\\}\\}$", "type": "string" } ], "description": "Processor architectures the app installs on, such as [x64, arm64] for an x64 app that also runs emulated on Arm. Null clears the restriction on an existing app; a list is required for creation." }, "assignments": { "anyOf": [ { "items": { "anyOf": [ { "additionalProperties": false, "if": { "required": [ "exclude_group" ] }, "oneOf": [ { "required": [ "group" ] }, { "required": [ "exclude_group" ] }, { "required": [ "all_devices" ] }, { "required": [ "all_users" ] } ], "properties": { "all_devices": { "anyOf": [ { "const": true }, { "pattern": "^\\{\\{[\\s\\S]+\\}\\}$", "type": "string" } ], "description": "Target all devices." }, "all_users": { "anyOf": [ { "const": true }, { "pattern": "^\\{\\{[\\s\\S]+\\}\\}$", "type": "string" } ], "description": "Target all licensed users." }, "exclude_group": { "anyOf": [ { "minLength": 1, "type": "string" }, { "pattern": "\\{\\{[\\s\\S]+\\}\\}", "type": "string" } ], "description": "Entra group object ID to exclude." }, "filter": { "anyOf": [ { "anyOf": [ { "additionalProperties": false, "properties": { "id": { "anyOf": [ { "minLength": 1, "type": "string" }, { "pattern": "\\{\\{[\\s\\S]+\\}\\}", "type": "string" } ], "description": "Intune assignment filter ID." }, "mode": { "anyOf": [ { "enum": [ "include", "exclude" ], "type": "string" }, { "pattern": "\\{\\{[\\s\\S]+\\}\\}", "type": "string" } ], "description": "Include or exclude the devices the filter matches." } }, "propertyNames": { "not": { "pattern": "\\{\\{" } }, "required": [ "id", "mode" ], "type": "object" }, { "type": "null" } ] }, { "pattern": "^\\{\\{[\\s\\S]+\\}\\}$", "type": "string" } ], "description": "Assignment filter for an included target; null removes it. Omit to keep the assignment's filter." }, "group": { "anyOf": [ { "minLength": 1, "type": "string" }, { "pattern": "\\{\\{[\\s\\S]+\\}\\}", "type": "string" } ], "description": "Entra group object ID to target." }, "intent": { "anyOf": [ { "enum": [ "required", "available", "uninstall", "available_without_enrollment" ], "type": "string" }, { "pattern": "\\{\\{[\\s\\S]+\\}\\}", "type": "string" } ], "description": "Deployment intent." }, "notifications": { "anyOf": [ { "enum": [ "show_all", "show_reboot", "hide_all" ], "type": "string" }, { "pattern": "\\{\\{[\\s\\S]+\\}\\}", "type": "string" } ], "description": "Win32 end-user notifications for an included target. Omit to keep the assignment's setting." } }, "propertyNames": { "not": { "pattern": "\\{\\{" } }, "required": [ "intent" ], "then": { "not": { "anyOf": [ { "required": [ "filter" ] }, { "required": [ "notifications" ] } ] } }, "type": "object" }, { "pattern": "^\\{\\{[\\s\\S]+\\}\\}$", "type": "string" } ] }, "maxItems": 1000, "type": "array" }, { "pattern": "^\\{\\{[\\s\\S]+\\}\\}$", "type": "string" } ], "description": "Own the complete assignment collection. Omission preserves targeting; [] clears assignments. Each assignment has one target, and settings it omits keep their values on a matching target." }, "categories": { "anyOf": [ { "items": { "anyOf": [ { "minLength": 1, "type": "string" }, { "pattern": "\\{\\{[\\s\\S]+\\}\\}", "type": "string" } ] }, "type": "array", "uniqueItems": true }, { "pattern": "^\\{\\{[\\s\\S]+\\}\\}$", "type": "string" } ], "description": "Company Portal categories by exact name. Missing categories are created. The list replaces the app's categories; omission preserves them and [] clears them." }, "dependencies": { "anyOf": [ { "items": { "anyOf": [ { "additionalProperties": false, "oneOf": [ { "required": [ "resource" ] }, { "required": [ "app_id" ] } ], "properties": { "app_id": { "anyOf": [ { "minLength": 1, "type": "string" }, { "pattern": "\\{\\{[\\s\\S]+\\}\\}", "type": "string" } ] }, "auto_install": { "anyOf": [ { "type": "boolean" }, { "pattern": "^\\{\\{[\\s\\S]+\\}\\}$", "type": "string" } ] }, "resource": { "$schema": "https://json-schema.org/draft/2020-12/schema", "anyOf": [ { "additionalProperties": false, "properties": { "apiVersion": { "anyOf": [ { "type": "string" }, { "pattern": "\\{\\{[\\s\\S]+\\}\\}", "type": "string" } ], "default": "stemma/v1alpha1" }, "kind": { "anyOf": [ { "minLength": 1, "type": "string" }, { "pattern": "\\{\\{[\\s\\S]+\\}\\}", "type": "string" } ] }, "name": { "anyOf": [ { "minLength": 1, "type": "string" }, { "pattern": "\\{\\{[\\s\\S]+\\}\\}", "type": "string" } ] } }, "propertyNames": { "not": { "pattern": "\\{\\{" } }, "required": [ "kind", "name" ], "type": "object" }, { "pattern": "^\\{\\{[\\s\\S]+\\}\\}$", "type": "string" } ] } }, "propertyNames": { "not": { "pattern": "\\{\\{" } }, "required": [ "auto_install" ], "type": "object" }, { "pattern": "^\\{\\{[\\s\\S]+\\}\\}$", "type": "string" } ] }, "maxItems": 99, "type": "array" }, { "pattern": "^\\{\\{[\\s\\S]+\\}\\}$", "type": "string" } ], "description": "Own this outgoing relationship category; [] clears it. Use resource for a publication on the same connection, or app_id for an external app." }, "description": { "anyOf": [ { "maxLength": 10000, "type": "string" }, { "pattern": "\\{\\{[\\s\\S]+\\}\\}", "type": "string" } ], "description": "App description. Required for creation." }, "detection": { "anyOf": [ { "contains": { "anyOf": [ { "additionalProperties": false, "if": { "required": [ "operator" ] }, "properties": { "operator": { "anyOf": [ { "enum": [ "equal", "not_equal", "greater_than", "greater_than_or_equal", "less_than", "less_than_or_equal" ], "type": "string" }, { "pattern": "\\{\\{[\\s\\S]+\\}\\}", "type": "string" } ], "description": "Comparison operator." }, "product_code": { "anyOf": [ { "minLength": 1, "type": "string" }, { "pattern": "\\{\\{[\\s\\S]+\\}\\}", "type": "string" } ], "description": "Exact MSI ProductCode GUID. Major MSI upgrades can change it; a version comparison only detects installations with this code. Declared detection overrides selected MSI defaults." }, "product_version": { "anyOf": [ { "maxLength": 10000, "type": "string" }, { "pattern": "\\{\\{[\\s\\S]+\\}\\}", "type": "string" } ], "description": "Version compared with the operator." }, "type": { "anyOf": [ { "const": "msi" }, { "pattern": "^\\{\\{[\\s\\S]+\\}\\}$", "type": "string" } ] } }, "propertyNames": { "not": { "pattern": "\\{\\{" } }, "required": [ "type", "product_code" ], "then": { "required": [ "product_version" ] }, "type": "object" }, { "pattern": "^\\{\\{[\\s\\S]+\\}\\}$", "type": "string" } ] }, "if": { "contains": { "anyOf": [ { "additionalProperties": false, "properties": { "enforce_signature_check": { "anyOf": [ { "type": "boolean" }, { "pattern": "^\\{\\{[\\s\\S]+\\}\\}$", "type": "string" } ] }, "run_as_32bit": { "anyOf": [ { "type": "boolean" }, { "pattern": "^\\{\\{[\\s\\S]+\\}\\}$", "type": "string" } ] }, "script": { "anyOf": [ { "maxLength": 200000, "minLength": 1, "type": "string" }, { "pattern": "\\{\\{[\\s\\S]+\\}\\}", "type": "string" } ], "description": "PowerShell detection script. Detection requires exit code 0, nonempty STDOUT and empty STDERR. Runs in the app install context. This is an alternative to other rules; preparation never executes it." }, "type": { "anyOf": [ { "const": "script" }, { "pattern": "^\\{\\{[\\s\\S]+\\}\\}$", "type": "string" } ] } }, "propertyNames": { "not": { "pattern": "\\{\\{" } }, "required": [ "type", "script" ], "type": "object" }, { "pattern": "^\\{\\{[\\s\\S]+\\}\\}$", "type": "string" } ] } }, "items": { "anyOf": [ { "oneOf": [ { "additionalProperties": false, "if": { "required": [ "operator" ] }, "properties": { "operator": { "anyOf": [ { "enum": [ "equal", "not_equal", "greater_than", "greater_than_or_equal", "less_than", "less_than_or_equal" ], "type": "string" }, { "pattern": "\\{\\{[\\s\\S]+\\}\\}", "type": "string" } ], "description": "Comparison operator." }, "product_code": { "anyOf": [ { "minLength": 1, "type": "string" }, { "pattern": "\\{\\{[\\s\\S]+\\}\\}", "type": "string" } ], "description": "Exact MSI ProductCode GUID. Major MSI upgrades can change it; a version comparison only detects installations with this code. Declared detection overrides selected MSI defaults." }, "product_version": { "anyOf": [ { "maxLength": 10000, "type": "string" }, { "pattern": "\\{\\{[\\s\\S]+\\}\\}", "type": "string" } ], "description": "Version compared with the operator." }, "type": { "anyOf": [ { "const": "msi" }, { "pattern": "^\\{\\{[\\s\\S]+\\}\\}$", "type": "string" } ] } }, "propertyNames": { "not": { "pattern": "\\{\\{" } }, "required": [ "type", "product_code" ], "then": { "required": [ "product_version" ] }, "type": "object" }, { "additionalProperties": false, "else": { "else": { "required": [ "operator", "value" ] }, "if": { "properties": { "property": { "anyOf": [ { "const": "version" }, { "pattern": "^\\{\\{[\\s\\S]+\\}\\}$", "type": "string" } ] } }, "propertyNames": { "not": { "pattern": "\\{\\{" } } } }, "if": { "properties": { "property": { "anyOf": [ { "const": "exists" }, { "pattern": "^\\{\\{[\\s\\S]+\\}\\}$", "type": "string" } ] } }, "propertyNames": { "not": { "pattern": "\\{\\{" } } }, "properties": { "check_32bit": { "anyOf": [ { "type": "boolean" }, { "pattern": "^\\{\\{[\\s\\S]+\\}\\}$", "type": "string" } ], "description": "Check the 32-bit location on 64-bit Windows." }, "name": { "anyOf": [ { "minLength": 1, "type": "string" }, { "pattern": "\\{\\{[\\s\\S]+\\}\\}", "type": "string" } ], "description": "File or folder name." }, "operator": { "anyOf": [ { "enum": [ "equal", "not_equal", "greater_than", "greater_than_or_equal", "less_than", "less_than_or_equal" ], "type": "string" }, { "pattern": "\\{\\{[\\s\\S]+\\}\\}", "type": "string" } ], "description": "Comparison operator. A version comparison defaults to greater_than_or_equal." }, "path": { "anyOf": [ { "minLength": 1, "type": "string" }, { "pattern": "\\{\\{[\\s\\S]+\\}\\}", "type": "string" } ] }, "property": { "anyOf": [ { "enum": [ "exists", "version", "size_mb", "modified", "created" ], "type": "string" }, { "pattern": "\\{\\{[\\s\\S]+\\}\\}", "type": "string" } ], "description": "Detected file property." }, "type": { "anyOf": [ { "const": "file" }, { "pattern": "^\\{\\{[\\s\\S]+\\}\\}$", "type": "string" } ] }, "value": { "anyOf": [ { "maxLength": 10000, "minLength": 1, "type": "string" }, { "pattern": "\\{\\{[\\s\\S]+\\}\\}", "type": "string" } ], "description": "Compared value. A version comparison defaults to the managed version. A stable file path with version greater_than_or_equal detects already-newer installations; equal intentionally does not." } }, "propertyNames": { "not": { "pattern": "\\{\\{" } }, "required": [ "type", "path", "name", "property" ], "then": { "not": { "anyOf": [ { "required": [ "operator" ] }, { "required": [ "value" ] } ] } }, "type": "object" }, { "additionalProperties": false, "else": { "else": { "required": [ "operator", "value" ] }, "if": { "properties": { "property": { "anyOf": [ { "const": "version" }, { "pattern": "^\\{\\{[\\s\\S]+\\}\\}$", "type": "string" } ] } }, "propertyNames": { "not": { "pattern": "\\{\\{" } } } }, "if": { "properties": { "property": { "anyOf": [ { "enum": [ "exists", "does_not_exist" ] }, { "pattern": "^\\{\\{[\\s\\S]+\\}\\}$", "type": "string" } ] } }, "propertyNames": { "not": { "pattern": "\\{\\{" } } }, "properties": { "check_32bit": { "anyOf": [ { "type": "boolean" }, { "pattern": "^\\{\\{[\\s\\S]+\\}\\}$", "type": "string" } ], "description": "Check the 32-bit view on 64-bit Windows." }, "key": { "anyOf": [ { "minLength": 1, "type": "string" }, { "pattern": "\\{\\{[\\s\\S]+\\}\\}", "type": "string" } ], "description": "Registry key path." }, "operator": { "anyOf": [ { "enum": [ "equal", "not_equal", "greater_than", "greater_than_or_equal", "less_than", "less_than_or_equal" ], "type": "string" }, { "pattern": "\\{\\{[\\s\\S]+\\}\\}", "type": "string" } ], "description": "Comparison operator. A version comparison defaults to greater_than_or_equal." }, "property": { "anyOf": [ { "enum": [ "exists", "does_not_exist", "string", "integer", "version" ], "type": "string" }, { "pattern": "\\{\\{[\\s\\S]+\\}\\}", "type": "string" } ], "description": "Registry comparison." }, "type": { "anyOf": [ { "const": "registry" }, { "pattern": "^\\{\\{[\\s\\S]+\\}\\}$", "type": "string" } ] }, "value": { "anyOf": [ { "type": "string" }, { "pattern": "\\{\\{[\\s\\S]+\\}\\}", "type": "string" } ], "description": "Compared value. A version comparison defaults to the managed version. Version greater_than_or_equal can detect already-newer installations at a stable vendor registry value." }, "value_name": { "anyOf": [ { "type": "string" }, { "pattern": "\\{\\{[\\s\\S]+\\}\\}", "type": "string" } ] } }, "propertyNames": { "not": { "pattern": "\\{\\{" } }, "required": [ "type", "key", "property" ], "then": { "not": { "anyOf": [ { "required": [ "operator" ] }, { "required": [ "value" ] } ] } }, "type": "object" }, { "additionalProperties": false, "properties": { "enforce_signature_check": { "anyOf": [ { "type": "boolean" }, { "pattern": "^\\{\\{[\\s\\S]+\\}\\}$", "type": "string" } ] }, "run_as_32bit": { "anyOf": [ { "type": "boolean" }, { "pattern": "^\\{\\{[\\s\\S]+\\}\\}$", "type": "string" } ] }, "script": { "anyOf": [ { "maxLength": 200000, "minLength": 1, "type": "string" }, { "pattern": "\\{\\{[\\s\\S]+\\}\\}", "type": "string" } ], "description": "PowerShell detection script. Detection requires exit code 0, nonempty STDOUT and empty STDERR. Runs in the app install context. This is an alternative to other rules; preparation never executes it." }, "type": { "anyOf": [ { "const": "script" }, { "pattern": "^\\{\\{[\\s\\S]+\\}\\}$", "type": "string" } ] } }, "propertyNames": { "not": { "pattern": "\\{\\{" } }, "required": [ "type", "script" ], "type": "object" } ] }, { "pattern": "^\\{\\{[\\s\\S]+\\}\\}$", "type": "string" } ] }, "maxContains": 1, "maxItems": 100, "minContains": 0, "then": { "maxItems": 1 }, "type": "array" }, { "pattern": "^\\{\\{[\\s\\S]+\\}\\}$", "type": "string" } ], "description": "Complete detection-rule collection. Selected MSI content defaults to its ProductCode with product_version greater_than_or_equal; a newer major version with another ProductCode needs file, registry or script detection. Rules are ANDed, with at most one msi rule. A script rule must be the only rule. Requirement rules are unsupported." }, "developer": { "anyOf": [ { "maxLength": 10000, "type": "string" }, { "pattern": "\\{\\{[\\s\\S]+\\}\\}", "type": "string" } ], "description": "Developer name." }, "display_name": { "anyOf": [ { "maxLength": 10000, "type": "string" }, { "pattern": "\\{\\{[\\s\\S]+\\}\\}", "type": "string" } ], "description": "Company Portal name. Required for creation." }, "featured": { "anyOf": [ { "type": "boolean" }, { "pattern": "^\\{\\{[\\s\\S]+\\}\\}$", "type": "string" } ], "description": "Show the app as featured. Explicit false is managed." }, "information_url": { "anyOf": [ { "maxLength": 10000, "type": "string" }, { "pattern": "\\{\\{[\\s\\S]+\\}\\}", "type": "string" } ], "description": "Publisher information URL." }, "inputs": { "additionalProperties": { "description": "Named output from this resource. Defaults to installer.", "pattern": "^[A-Za-z0-9][A-Za-z0-9._-]{0,127}$", "type": "string" }, "propertyNames": { "pattern": "^[A-Za-z0-9][A-Za-z0-9._-]{0,127}$" }, "type": "object" }, "install_command": { "anyOf": [ { "maxLength": 10000, "type": "string" }, { "pattern": "\\{\\{[\\s\\S]+\\}\\}", "type": "string" } ], "description": "Silent Windows install command. Selected MSI content defaults to msiexec /i with /qn /norestart; EXE switches and architecture-specific executable paths are explicit. Payloads and hooks are never executed during preparation." }, "install_experience": { "anyOf": [ { "additionalProperties": false, "properties": { "restart": { "anyOf": [ { "enum": [ "based_on_return_code", "allow", "suppress", "force" ], "type": "string" }, { "pattern": "\\{\\{[\\s\\S]+\\}\\}", "type": "string" } ], "description": "Installer restart handling; omitted fields are preserved." }, "run_as": { "anyOf": [ { "enum": [ "system", "user" ], "type": "string" }, { "pattern": "\\{\\{[\\s\\S]+\\}\\}", "type": "string" } ], "description": "Install as system or user. Required for creation." } }, "propertyNames": { "not": { "pattern": "\\{\\{" } }, "type": "object" }, { "pattern": "^\\{\\{[\\s\\S]+\\}\\}$", "type": "string" } ] }, "installer": { "description": "Named output from this resource. Defaults to installer.", "pattern": "^[A-Za-z0-9][A-Za-z0-9._-]{0,127}$", "type": "string" }, "minimum_cpu_speed_mhz": { "anyOf": [ { "maximum": 2147483647, "minimum": 0, "type": "integer" }, { "pattern": "^\\{\\{[\\s\\S]+\\}\\}$", "type": "string" } ], "description": "Minimum CPU speed in MHz. Omit to leave unchanged." }, "minimum_disk_space_mb": { "anyOf": [ { "maximum": 2147483647, "minimum": 0, "type": "integer" }, { "pattern": "^\\{\\{[\\s\\S]+\\}\\}$", "type": "string" } ], "description": "Minimum free disk space in MB. Omit to leave unchanged." }, "minimum_memory_mb": { "anyOf": [ { "maximum": 2147483647, "minimum": 0, "type": "integer" }, { "pattern": "^\\{\\{[\\s\\S]+\\}\\}$", "type": "string" } ], "description": "Minimum memory in MB. Omit to leave unchanged." }, "minimum_processors": { "anyOf": [ { "maximum": 2147483647, "minimum": 0, "type": "integer" }, { "pattern": "^\\{\\{[\\s\\S]+\\}\\}$", "type": "string" } ], "description": "Minimum number of processors. Omit to leave unchanged." }, "minimum_windows_release": { "anyOf": [ { "maxLength": 10000, "type": "string" }, { "pattern": "\\{\\{[\\s\\S]+\\}\\}", "type": "string" } ], "description": "Minimum Windows release, such as Windows11_23H2. Required for creation." }, "msi": { "anyOf": [ { "additionalProperties": false, "properties": { "package_type": { "anyOf": [ { "enum": [ "per_machine", "per_user", "dual_purpose" ], "type": "string" }, { "pattern": "\\{\\{[\\s\\S]+\\}\\}", "type": "string" } ], "description": "MSI installation scope." }, "product_code": { "anyOf": [ { "maxLength": 10000, "type": "string" }, { "pattern": "\\{\\{[\\s\\S]+\\}\\}", "type": "string" } ] }, "product_name": { "anyOf": [ { "maxLength": 10000, "type": "string" }, { "pattern": "\\{\\{[\\s\\S]+\\}\\}", "type": "string" } ] }, "product_version": { "anyOf": [ { "maxLength": 10000, "type": "string" }, { "pattern": "\\{\\{[\\s\\S]+\\}\\}", "type": "string" } ] }, "publisher": { "anyOf": [ { "maxLength": 10000, "type": "string" }, { "pattern": "\\{\\{[\\s\\S]+\\}\\}", "type": "string" } ] }, "requires_reboot": { "anyOf": [ { "type": "boolean" }, { "pattern": "^\\{\\{[\\s\\S]+\\}\\}$", "type": "string" } ] }, "upgrade_code": { "anyOf": [ { "anyOf": [ { "maxLength": 10000, "type": "string" }, { "type": "null" } ] }, { "pattern": "^\\{\\{[\\s\\S]+\\}\\}$", "type": "string" } ] } }, "propertyNames": { "not": { "pattern": "\\{\\{" } }, "type": "object" }, { "pattern": "^\\{\\{[\\s\\S]+\\}\\}$", "type": "string" } ], "description": "MSI information. The selected setup MSI supplies it; declared fields override it." }, "msi_properties": { "anyOf": [ { "additionalProperties": { "anyOf": [ { "pattern": "^[^\\r\\n\\x00]*$", "type": "string" }, { "pattern": "\\{\\{[\\s\\S]+\\}\\}", "type": "string" } ] }, "minProperties": 1, "propertyNames": { "allOf": [ { "pattern": "^[A-Za-z_][A-Za-z0-9_.]*$" }, { "not": { "pattern": "\\{\\{" } } ] }, "type": "object" }, { "pattern": "^\\{\\{[\\s\\S]+\\}\\}$", "type": "string" } ], "description": "Windows Installer properties the derived install command passes to the selected setup MSI, such as PORTAL for GlobalProtect. Values are quoted in name order. Use instead of install_command." }, "notes": { "anyOf": [ { "maxLength": 10000, "type": "string" }, { "pattern": "\\{\\{[\\s\\S]+\\}\\}", "type": "string" } ], "description": "Administrator notes. A reserved marker line follows them: it identifies the app and records its published content, so it must stay intact." }, "owner": { "anyOf": [ { "maxLength": 10000, "type": "string" }, { "pattern": "\\{\\{[\\s\\S]+\\}\\}", "type": "string" } ], "description": "Owner label." }, "privacy_url": { "anyOf": [ { "maxLength": 10000, "type": "string" }, { "pattern": "\\{\\{[\\s\\S]+\\}\\}", "type": "string" } ], "description": "Publisher privacy information URL." }, "publisher": { "anyOf": [ { "maxLength": 10000, "type": "string" }, { "pattern": "\\{\\{[\\s\\S]+\\}\\}", "type": "string" } ], "description": "Publisher name. Required for creation." }, "return_codes": { "anyOf": [ { "items": { "anyOf": [ { "additionalProperties": false, "properties": { "code": { "anyOf": [ { "maximum": 2147483647, "minimum": -2147483648, "type": "integer" }, { "pattern": "^\\{\\{[\\s\\S]+\\}\\}$", "type": "string" } ] }, "type": { "anyOf": [ { "enum": [ "success", "soft_reboot", "hard_reboot", "retry", "failed" ], "type": "string" }, { "pattern": "\\{\\{[\\s\\S]+\\}\\}", "type": "string" } ], "description": "Result classification." } }, "propertyNames": { "not": { "pattern": "\\{\\{" } }, "required": [ "code", "type" ], "type": "object" }, { "pattern": "^\\{\\{[\\s\\S]+\\}\\}$", "type": "string" } ] }, "type": "array" }, { "pattern": "^\\{\\{[\\s\\S]+\\}\\}$", "type": "string" } ], "description": "Replace the return-code collection; an empty array clears it." }, "supersedes": { "anyOf": [ { "items": { "anyOf": [ { "additionalProperties": false, "oneOf": [ { "required": [ "resource" ] }, { "required": [ "app_id" ] } ], "properties": { "app_id": { "anyOf": [ { "minLength": 1, "type": "string" }, { "pattern": "\\{\\{[\\s\\S]+\\}\\}", "type": "string" } ] }, "resource": { "$schema": "https://json-schema.org/draft/2020-12/schema", "anyOf": [ { "additionalProperties": false, "properties": { "apiVersion": { "anyOf": [ { "type": "string" }, { "pattern": "\\{\\{[\\s\\S]+\\}\\}", "type": "string" } ], "default": "stemma/v1alpha1" }, "kind": { "anyOf": [ { "minLength": 1, "type": "string" }, { "pattern": "\\{\\{[\\s\\S]+\\}\\}", "type": "string" } ] }, "name": { "anyOf": [ { "minLength": 1, "type": "string" }, { "pattern": "\\{\\{[\\s\\S]+\\}\\}", "type": "string" } ] } }, "propertyNames": { "not": { "pattern": "\\{\\{" } }, "required": [ "kind", "name" ], "type": "object" }, { "pattern": "^\\{\\{[\\s\\S]+\\}\\}$", "type": "string" } ] }, "uninstall_previous": { "anyOf": [ { "type": "boolean" }, { "pattern": "^\\{\\{[\\s\\S]+\\}\\}$", "type": "string" } ] } }, "propertyNames": { "not": { "pattern": "\\{\\{" } }, "required": [ "uninstall_previous" ], "type": "object" }, { "pattern": "^\\{\\{[\\s\\S]+\\}\\}$", "type": "string" } ] }, "maxItems": 9, "type": "array" }, { "pattern": "^\\{\\{[\\s\\S]+\\}\\}$", "type": "string" } ], "description": "Own this outgoing relationship category; [] clears it. Use resource for a publication on the same connection, or app_id for an external app." }, "type": { "anyOf": [ { "const": "win32" }, { "pattern": "^\\{\\{[\\s\\S]+\\}\\}$", "type": "string" } ], "description": "Windows software publishes a Win32 app, so this is the default." }, "uninstall_command": { "anyOf": [ { "maxLength": 10000, "type": "string" }, { "pattern": "\\{\\{[\\s\\S]+\\}\\}", "type": "string" } ], "description": "Windows uninstall command. Selected MSI content defaults to msiexec /x ProductCode /qn /norestart; EXE uninstall behavior is explicit." } }, "propertyNames": { "not": { "pattern": "\\{\\{" } }, "title": "Win32 app", "type": "object" }, { "additionalProperties": false, "properties": { "app_id": { "anyOf": [ { "minLength": 1, "type": "string" }, { "pattern": "\\{\\{[\\s\\S]+\\}\\}", "type": "string" } ], "description": "Pin this software to an existing Intune app, which must exist and must not carry another software's identity marker. Omit to find the app by the identity marker in its notes, or create one." }, "assignments": { "anyOf": [ { "items": { "anyOf": [ { "additionalProperties": false, "if": { "required": [ "exclude_group" ] }, "oneOf": [ { "required": [ "group" ] }, { "required": [ "exclude_group" ] }, { "required": [ "all_devices" ] }, { "required": [ "all_users" ] } ], "properties": { "all_devices": { "anyOf": [ { "const": true }, { "pattern": "^\\{\\{[\\s\\S]+\\}\\}$", "type": "string" } ], "description": "Target all devices." }, "all_users": { "anyOf": [ { "const": true }, { "pattern": "^\\{\\{[\\s\\S]+\\}\\}$", "type": "string" } ], "description": "Target all licensed users." }, "exclude_group": { "anyOf": [ { "minLength": 1, "type": "string" }, { "pattern": "\\{\\{[\\s\\S]+\\}\\}", "type": "string" } ], "description": "Entra group object ID to exclude." }, "filter": { "anyOf": [ { "anyOf": [ { "additionalProperties": false, "properties": { "id": { "anyOf": [ { "minLength": 1, "type": "string" }, { "pattern": "\\{\\{[\\s\\S]+\\}\\}", "type": "string" } ], "description": "Intune assignment filter ID." }, "mode": { "anyOf": [ { "enum": [ "include", "exclude" ], "type": "string" }, { "pattern": "\\{\\{[\\s\\S]+\\}\\}", "type": "string" } ], "description": "Include or exclude the devices the filter matches." } }, "propertyNames": { "not": { "pattern": "\\{\\{" } }, "required": [ "id", "mode" ], "type": "object" }, { "type": "null" } ] }, { "pattern": "^\\{\\{[\\s\\S]+\\}\\}$", "type": "string" } ], "description": "Assignment filter for an included target; null removes it. Omit to keep the assignment's filter." }, "group": { "anyOf": [ { "minLength": 1, "type": "string" }, { "pattern": "\\{\\{[\\s\\S]+\\}\\}", "type": "string" } ], "description": "Entra group object ID to target." }, "intent": { "anyOf": [ { "enum": [ "required", "available", "uninstall", "available_without_enrollment" ], "type": "string" }, { "pattern": "\\{\\{[\\s\\S]+\\}\\}", "type": "string" } ], "description": "Deployment intent." } }, "propertyNames": { "not": { "pattern": "\\{\\{" } }, "required": [ "intent" ], "then": { "not": { "anyOf": [ { "required": [ "filter" ] }, { "required": [ "notifications" ] } ] } }, "type": "object" }, { "pattern": "^\\{\\{[\\s\\S]+\\}\\}$", "type": "string" } ] }, "maxItems": 1000, "type": "array" }, { "pattern": "^\\{\\{[\\s\\S]+\\}\\}$", "type": "string" } ], "description": "Own the complete assignment collection. Omission preserves targeting; [] clears assignments. Each assignment has one target, and settings it omits keep their values on a matching target." }, "categories": { "anyOf": [ { "items": { "anyOf": [ { "minLength": 1, "type": "string" }, { "pattern": "\\{\\{[\\s\\S]+\\}\\}", "type": "string" } ] }, "type": "array", "uniqueItems": true }, { "pattern": "^\\{\\{[\\s\\S]+\\}\\}$", "type": "string" } ], "description": "Company Portal categories by exact name. Missing categories are created. The list replaces the app's categories; omission preserves them and [] clears them." }, "description": { "anyOf": [ { "maxLength": 10000, "type": "string" }, { "pattern": "\\{\\{[\\s\\S]+\\}\\}", "type": "string" } ], "description": "App description. Required for creation." }, "developer": { "anyOf": [ { "maxLength": 10000, "type": "string" }, { "pattern": "\\{\\{[\\s\\S]+\\}\\}", "type": "string" } ], "description": "Developer name." }, "display_name": { "anyOf": [ { "maxLength": 10000, "type": "string" }, { "pattern": "\\{\\{[\\s\\S]+\\}\\}", "type": "string" } ], "description": "Company Portal name. Required for creation." }, "featured": { "anyOf": [ { "type": "boolean" }, { "pattern": "^\\{\\{[\\s\\S]+\\}\\}$", "type": "string" } ], "description": "Show the app as featured. Explicit false is managed." }, "ignore_version_detection": { "anyOf": [ { "type": "boolean" }, { "pattern": "^\\{\\{[\\s\\S]+\\}\\}$", "type": "string" } ], "description": "Ignore installed app versions during detection. Explicit false is managed." }, "included_apps": { "anyOf": [ { "items": { "anyOf": [ { "anyOf": [ { "additionalProperties": false, "properties": { "id": { "anyOf": [ { "maxLength": 1000, "minLength": 1, "type": "string" }, { "pattern": "\\{\\{[\\s\\S]+\\}\\}", "type": "string" } ], "description": "Application bundle identifier, or package receipt identifier for a PKG app." }, "version": { "anyOf": [ { "maxLength": 1000, "minLength": 1, "type": "string" }, { "pattern": "\\{\\{[\\s\\S]+\\}\\}", "type": "string" } ], "description": "Application CFBundleShortVersionString or package receipt version." } }, "propertyNames": { "not": { "pattern": "\\{\\{" } }, "required": [ "id", "version" ], "type": "object" }, { "additionalProperties": true, "propertyNames": { "not": { "pattern": "\\{\\{" } }, "required": [ "kind" ], "type": "object" } ] }, { "pattern": "^\\{\\{[\\s\\S]+\\}\\}$", "type": "string" } ] }, "maxItems": 500, "minItems": 1, "type": "array" }, { "pattern": "^\\{\\{[\\s\\S]+\\}\\}$", "type": "string" } ], "description": "Identifiers and versions that detect the installation; every entry must be installed and the first identifies the app. Entries can be identifier/version pairs or inspected subjects, written as expressions such as {{ facts.name }}. Applications use their short version, with their build preserved for line-of-business apps. PKG apps also accept package subjects with a payload, which leaves a receipt. DMG and line-of-business subjects must be applications installed under /Applications. Omission derives the list from the selected application, or from payload receipts when a PKG selects no application. Explicit entries replace the derived list. Identifiers must be unique." }, "information_url": { "anyOf": [ { "maxLength": 10000, "type": "string" }, { "pattern": "\\{\\{[\\s\\S]+\\}\\}", "type": "string" } ], "description": "Publisher information URL." }, "inputs": { "additionalProperties": { "description": "Named output from this resource. Defaults to installer.", "pattern": "^[A-Za-z0-9][A-Za-z0-9._-]{0,127}$", "type": "string" }, "propertyNames": { "pattern": "^[A-Za-z0-9][A-Za-z0-9._-]{0,127}$" }, "type": "object" }, "installer": { "description": "Named output from this resource. Defaults to installer.", "pattern": "^[A-Za-z0-9][A-Za-z0-9._-]{0,127}$", "type": "string" }, "notes": { "anyOf": [ { "maxLength": 10000, "type": "string" }, { "pattern": "\\{\\{[\\s\\S]+\\}\\}", "type": "string" } ], "description": "Administrator notes. A reserved marker line follows them: it identifies the app and records its published content, so it must stay intact." }, "owner": { "anyOf": [ { "maxLength": 10000, "type": "string" }, { "pattern": "\\{\\{[\\s\\S]+\\}\\}", "type": "string" } ], "description": "Owner label." }, "post_install_script": { "anyOf": [ { "anyOf": [ { "maxLength": 15359, "minLength": 1, "type": "string" }, { "type": "null" } ] }, { "pattern": "^\\{\\{[\\s\\S]+\\}\\}$", "type": "string" } ], "description": "Script that runs after a PKG app installs. Intune reports the app as installed whatever the script's exit status. PKG apps only; a disk image app has no scripts. Null removes the script. Plans report a change without the script text. Never executed by Stemma." }, "pre_install_script": { "anyOf": [ { "anyOf": [ { "maxLength": 15359, "minLength": 1, "type": "string" }, { "type": "null" } ] }, { "pattern": "^\\{\\{[\\s\\S]+\\}\\}$", "type": "string" } ], "description": "Script that runs before a PKG app installs. A nonzero exit stops the installation, which Intune tries again at the next check-in. PKG apps only; a disk image app has no scripts. Null removes the script. Plans report a change without the script text. Never executed by Stemma." }, "privacy_url": { "anyOf": [ { "maxLength": 10000, "type": "string" }, { "pattern": "\\{\\{[\\s\\S]+\\}\\}", "type": "string" } ], "description": "Publisher privacy information URL." }, "publisher": { "anyOf": [ { "maxLength": 10000, "type": "string" }, { "pattern": "\\{\\{[\\s\\S]+\\}\\}", "type": "string" } ], "description": "Publisher name. Required for creation." }, "type": { "anyOf": [ { "enum": [ "pkg", "dmg" ] }, { "pattern": "^\\{\\{[\\s\\S]+\\}\\}$", "type": "string" } ], "description": "A Mac app follows its installer: pkg for a PKG and dmg for a disk image." } }, "propertyNames": { "not": { "pattern": "\\{\\{" } }, "title": "Mac app", "type": "object" }, { "additionalProperties": false, "properties": { "app_id": { "anyOf": [ { "minLength": 1, "type": "string" }, { "pattern": "\\{\\{[\\s\\S]+\\}\\}", "type": "string" } ], "description": "Pin this software to an existing Intune app, which must exist and must not carry another software's identity marker. Omit to find the app by the identity marker in its notes, or create one." }, "assignments": { "anyOf": [ { "items": { "anyOf": [ { "additionalProperties": false, "if": { "required": [ "exclude_group" ] }, "oneOf": [ { "required": [ "group" ] }, { "required": [ "exclude_group" ] }, { "required": [ "all_devices" ] }, { "required": [ "all_users" ] } ], "properties": { "all_devices": { "anyOf": [ { "const": true }, { "pattern": "^\\{\\{[\\s\\S]+\\}\\}$", "type": "string" } ], "description": "Target all devices." }, "all_users": { "anyOf": [ { "const": true }, { "pattern": "^\\{\\{[\\s\\S]+\\}\\}$", "type": "string" } ], "description": "Target all licensed users." }, "exclude_group": { "anyOf": [ { "minLength": 1, "type": "string" }, { "pattern": "\\{\\{[\\s\\S]+\\}\\}", "type": "string" } ], "description": "Entra group object ID to exclude." }, "filter": { "anyOf": [ { "anyOf": [ { "additionalProperties": false, "properties": { "id": { "anyOf": [ { "minLength": 1, "type": "string" }, { "pattern": "\\{\\{[\\s\\S]+\\}\\}", "type": "string" } ], "description": "Intune assignment filter ID." }, "mode": { "anyOf": [ { "enum": [ "include", "exclude" ], "type": "string" }, { "pattern": "\\{\\{[\\s\\S]+\\}\\}", "type": "string" } ], "description": "Include or exclude the devices the filter matches." } }, "propertyNames": { "not": { "pattern": "\\{\\{" } }, "required": [ "id", "mode" ], "type": "object" }, { "type": "null" } ] }, { "pattern": "^\\{\\{[\\s\\S]+\\}\\}$", "type": "string" } ], "description": "Assignment filter for an included target; null removes it. Omit to keep the assignment's filter." }, "group": { "anyOf": [ { "minLength": 1, "type": "string" }, { "pattern": "\\{\\{[\\s\\S]+\\}\\}", "type": "string" } ], "description": "Entra group object ID to target." }, "intent": { "anyOf": [ { "enum": [ "required", "available", "uninstall", "available_without_enrollment" ], "type": "string" }, { "pattern": "\\{\\{[\\s\\S]+\\}\\}", "type": "string" } ], "description": "Deployment intent." } }, "propertyNames": { "not": { "pattern": "\\{\\{" } }, "required": [ "intent" ], "then": { "not": { "anyOf": [ { "required": [ "filter" ] }, { "required": [ "notifications" ] } ] } }, "type": "object" }, { "pattern": "^\\{\\{[\\s\\S]+\\}\\}$", "type": "string" } ] }, "maxItems": 1000, "type": "array" }, { "pattern": "^\\{\\{[\\s\\S]+\\}\\}$", "type": "string" } ], "description": "Own the complete assignment collection. Omission preserves targeting; [] clears assignments. Each assignment has one target, and settings it omits keep their values on a matching target." }, "categories": { "anyOf": [ { "items": { "anyOf": [ { "minLength": 1, "type": "string" }, { "pattern": "\\{\\{[\\s\\S]+\\}\\}", "type": "string" } ] }, "type": "array", "uniqueItems": true }, { "pattern": "^\\{\\{[\\s\\S]+\\}\\}$", "type": "string" } ], "description": "Company Portal categories by exact name. Missing categories are created. The list replaces the app's categories; omission preserves them and [] clears them." }, "description": { "anyOf": [ { "maxLength": 10000, "type": "string" }, { "pattern": "\\{\\{[\\s\\S]+\\}\\}", "type": "string" } ], "description": "App description. Required for creation." }, "developer": { "anyOf": [ { "maxLength": 10000, "type": "string" }, { "pattern": "\\{\\{[\\s\\S]+\\}\\}", "type": "string" } ], "description": "Developer name." }, "display_name": { "anyOf": [ { "maxLength": 10000, "type": "string" }, { "pattern": "\\{\\{[\\s\\S]+\\}\\}", "type": "string" } ], "description": "Company Portal name. Required for creation." }, "featured": { "anyOf": [ { "type": "boolean" }, { "pattern": "^\\{\\{[\\s\\S]+\\}\\}$", "type": "string" } ], "description": "Show the app as featured. Explicit false is managed." }, "ignore_version_detection": { "anyOf": [ { "type": "boolean" }, { "pattern": "^\\{\\{[\\s\\S]+\\}\\}$", "type": "string" } ], "description": "Ignore installed app versions during detection. Explicit false is managed." }, "included_apps": { "anyOf": [ { "items": { "anyOf": [ { "anyOf": [ { "additionalProperties": false, "properties": { "id": { "anyOf": [ { "maxLength": 1000, "minLength": 1, "type": "string" }, { "pattern": "\\{\\{[\\s\\S]+\\}\\}", "type": "string" } ], "description": "Application bundle identifier, or package receipt identifier for a PKG app." }, "version": { "anyOf": [ { "maxLength": 1000, "minLength": 1, "type": "string" }, { "pattern": "\\{\\{[\\s\\S]+\\}\\}", "type": "string" } ], "description": "Application CFBundleShortVersionString or package receipt version." } }, "propertyNames": { "not": { "pattern": "\\{\\{" } }, "required": [ "id", "version" ], "type": "object" }, { "additionalProperties": true, "propertyNames": { "not": { "pattern": "\\{\\{" } }, "required": [ "kind" ], "type": "object" } ] }, { "pattern": "^\\{\\{[\\s\\S]+\\}\\}$", "type": "string" } ] }, "maxItems": 500, "minItems": 1, "type": "array" }, { "pattern": "^\\{\\{[\\s\\S]+\\}\\}$", "type": "string" } ], "description": "Identifiers and versions that detect the installation; every entry must be installed and the first identifies the app. Entries can be identifier/version pairs or inspected subjects, written as expressions such as {{ facts.name }}. Applications use their short version, with their build preserved for line-of-business apps. PKG apps also accept package subjects with a payload, which leaves a receipt. DMG and line-of-business subjects must be applications installed under /Applications. Omission derives the list from the selected application, or from payload receipts when a PKG selects no application. Explicit entries replace the derived list. Identifiers must be unique." }, "information_url": { "anyOf": [ { "maxLength": 10000, "type": "string" }, { "pattern": "\\{\\{[\\s\\S]+\\}\\}", "type": "string" } ], "description": "Publisher information URL." }, "inputs": { "additionalProperties": { "description": "Named output from this resource. Defaults to installer.", "pattern": "^[A-Za-z0-9][A-Za-z0-9._-]{0,127}$", "type": "string" }, "propertyNames": { "pattern": "^[A-Za-z0-9][A-Za-z0-9._-]{0,127}$" }, "type": "object" }, "install_as_managed": { "anyOf": [ { "type": "boolean" }, { "pattern": "^\\{\\{[\\s\\S]+\\}\\}$", "type": "string" } ], "description": "Install the app as managed on macOS 11 or later. The PKG must have one component that installs one application under /Applications." }, "installer": { "description": "Named output from this resource. Defaults to installer.", "pattern": "^[A-Za-z0-9][A-Za-z0-9._-]{0,127}$", "type": "string" }, "notes": { "anyOf": [ { "maxLength": 10000, "type": "string" }, { "pattern": "\\{\\{[\\s\\S]+\\}\\}", "type": "string" } ], "description": "Administrator notes. A reserved marker line follows them: it identifies the app and records its published content, so it must stay intact." }, "owner": { "anyOf": [ { "maxLength": 10000, "type": "string" }, { "pattern": "\\{\\{[\\s\\S]+\\}\\}", "type": "string" } ], "description": "Owner label." }, "privacy_url": { "anyOf": [ { "maxLength": 10000, "type": "string" }, { "pattern": "\\{\\{[\\s\\S]+\\}\\}", "type": "string" } ], "description": "Publisher privacy information URL." }, "publisher": { "anyOf": [ { "maxLength": 10000, "type": "string" }, { "pattern": "\\{\\{[\\s\\S]+\\}\\}", "type": "string" } ], "description": "Publisher name. Required for creation." }, "type": { "anyOf": [ { "const": "lob" }, { "pattern": "^\\{\\{[\\s\\S]+\\}\\}$", "type": "string" } ], "description": "Publish the signed PKG as a line-of-business app. The PKG must install an application under /Applications." } }, "propertyNames": { "not": { "pattern": "\\{\\{" } }, "required": [ "type" ], "title": "Mac line-of-business app", "type": "object" } ], "description": "Intune app metadata. Windows software publishes a Win32 envelope; Mac software publishes its PKG or DMG, or a signed PKG as a line-of-business app. The minimum macOS derives from the software's minimum_os and its installer.", "properties": { "inputs": { "additionalProperties": { "description": "Named output from this resource. Defaults to installer.", "pattern": "^[A-Za-z0-9][A-Za-z0-9._-]{0,127}$", "type": "string" }, "propertyNames": { "pattern": "^[A-Za-z0-9][A-Za-z0-9._-]{0,127}$" }, "type": "object" }, "installer": { "description": "Named output from this resource. Defaults to installer.", "pattern": "^[A-Za-z0-9][A-Za-z0-9._-]{0,127}$", "type": "string" } } }, "OperationMetadata_jamf": { "$id": "https://stemma.invalid/editor/jamf/metadata", "additionalProperties": false, "description": "Jamf Pro package metadata. Omitted fields are left unchanged; explicit false, zero and empty strings are managed. Only the documented nullable fields accept null. Each artifact filename has its own package, identified by Stemma's marker in its notes; changed bytes under the same filename are uploaded into that package. Install policies, patch deployment and retention are opt-in.", "properties": { "category": { "anyOf": [ { "anyOf": [ { "minLength": 1, "type": "string" }, { "type": "null" } ] }, { "pattern": "^\\{\\{[\\s\\S]+\\}\\}$", "type": "string" } ], "description": "Category name, which must match exactly one Jamf category. Null removes the category." }, "info": { "anyOf": [ { "anyOf": [ { "type": "string" }, { "type": "null" } ] }, { "pattern": "^\\{\\{[\\s\\S]+\\}\\}$", "type": "string" } ], "description": "Package information. Null clears the field." }, "inputs": { "additionalProperties": { "description": "Named output from this resource. Defaults to installer.", "pattern": "^[A-Za-z0-9][A-Za-z0-9._-]{0,127}$", "type": "string" }, "propertyNames": { "pattern": "^[A-Za-z0-9][A-Za-z0-9._-]{0,127}$" }, "type": "object" }, "installer": { "description": "Named output from this resource. Defaults to installer.", "pattern": "^[A-Za-z0-9][A-Za-z0-9._-]{0,127}$", "type": "string" }, "notes": { "anyOf": [ { "anyOf": [ { "type": "string" }, { "type": "null" } ] }, { "pattern": "^\\{\\{[\\s\\S]+\\}\\}$", "type": "string" } ], "description": "Administrator notes. Null clears the text. Stemma keeps its identity marker on the final line and preserves the remote text when this is omitted." }, "os_requirements": { "anyOf": [ { "anyOf": [ { "type": "string" }, { "type": "null" } ] }, { "pattern": "^\\{\\{[\\s\\S]+\\}\\}$", "type": "string" } ], "description": "Operating system requirement expression, such as 14.x, 15.x. Null clears the field." }, "package_id": { "anyOf": [ { "minimum": 1, "type": "integer" }, { "pattern": "^\\{\\{[\\s\\S]+\\}\\}$", "type": "string" } ], "description": "Publish into this existing Jamf package instead of discovering one. The package takes Stemma's identity marker, the artifact filename, the artifact's content when it differs, and the declared metadata; a package marked for other software is refused. Omit to find the package by its marker and artifact filename, or create it." }, "patch": { "anyOf": [ { "additionalProperties": false, "properties": { "policy": { "anyOf": [ { "additionalProperties": false, "properties": { "allow_downgrade": { "anyOf": [ { "type": "boolean" }, { "pattern": "^\\{\\{[\\s\\S]+\\}\\}$", "type": "string" } ], "description": "Also install the target version on computers that have a newer one, as when the catalog returns to an earlier release." }, "deadline_days": { "anyOf": [ { "anyOf": [ { "minimum": 1, "type": "integer" }, { "type": "null" } ] }, { "pattern": "^\\{\\{[\\s\\S]+\\}\\}$", "type": "string" } ], "description": "Days an update is offered in Self Service before it installs automatically; it needs distribution: self_service. Null removes the deadline." }, "distribution": { "anyOf": [ { "enum": [ "automatic", "self_service" ], "type": "string" }, { "pattern": "\\{\\{[\\s\\S]+\\}\\}", "type": "string" } ], "description": "Install updates automatically, or offer them in Self Service with a notification and reminders." }, "enabled": { "anyOf": [ { "type": "boolean" }, { "pattern": "^\\{\\{[\\s\\S]+\\}\\}$", "type": "string" } ], "description": "Enable the policy. A policy Stemma creates starts disabled." }, "grace_minutes": { "anyOf": [ { "minimum": 0, "type": "integer" }, { "pattern": "^\\{\\{[\\s\\S]+\\}\\}$", "type": "string" } ], "description": "Minutes users have to save their work before the title's apps quit for an automatic update." }, "name": { "anyOf": [ { "minLength": 1, "type": "string" }, { "pattern": "\\{\\{[\\s\\S]+\\}\\}", "type": "string" } ], "description": "Policy name within the title. Defaults to the software name." }, "patch_unknown": { "anyOf": [ { "type": "boolean" }, { "pattern": "^\\{\\{[\\s\\S]+\\}\\}$", "type": "string" } ], "description": "Also update computers whose installed version the title does not define." }, "reminder_days": { "anyOf": [ { "anyOf": [ { "minimum": 1, "type": "integer" }, { "type": "null" } ] }, { "pattern": "^\\{\\{[\\s\\S]+\\}\\}$", "type": "string" } ], "description": "Days between reminders about an update offered in Self Service; it needs distribution: self_service. Defaults to 1; null turns reminders off." }, "scope": { "anyOf": [ { "additionalProperties": false, "properties": { "all_computers": { "anyOf": [ { "type": "boolean" }, { "pattern": "^\\{\\{[\\s\\S]+\\}\\}$", "type": "string" } ] }, "buildings": { "anyOf": [ { "items": { "anyOf": [ { "type": "string" }, { "pattern": "\\{\\{[\\s\\S]+\\}\\}", "type": "string" } ] }, "type": "array" }, { "pattern": "^\\{\\{[\\s\\S]+\\}\\}$", "type": "string" } ] }, "computer_groups": { "anyOf": [ { "items": { "anyOf": [ { "type": "string" }, { "pattern": "\\{\\{[\\s\\S]+\\}\\}", "type": "string" } ] }, "type": "array" }, { "pattern": "^\\{\\{[\\s\\S]+\\}\\}$", "type": "string" } ] }, "computers": { "anyOf": [ { "items": { "anyOf": [ { "type": "string" }, { "pattern": "\\{\\{[\\s\\S]+\\}\\}", "type": "string" } ] }, "type": "array" }, { "pattern": "^\\{\\{[\\s\\S]+\\}\\}$", "type": "string" } ] }, "departments": { "anyOf": [ { "items": { "anyOf": [ { "type": "string" }, { "pattern": "\\{\\{[\\s\\S]+\\}\\}", "type": "string" } ] }, "type": "array" }, { "pattern": "^\\{\\{[\\s\\S]+\\}\\}$", "type": "string" } ] }, "exclusions": { "anyOf": [ { "additionalProperties": false, "properties": { "buildings": { "anyOf": [ { "items": { "anyOf": [ { "type": "string" }, { "pattern": "\\{\\{[\\s\\S]+\\}\\}", "type": "string" } ] }, "type": "array" }, { "pattern": "^\\{\\{[\\s\\S]+\\}\\}$", "type": "string" } ] }, "computer_groups": { "anyOf": [ { "items": { "anyOf": [ { "type": "string" }, { "pattern": "\\{\\{[\\s\\S]+\\}\\}", "type": "string" } ] }, "type": "array" }, { "pattern": "^\\{\\{[\\s\\S]+\\}\\}$", "type": "string" } ] }, "computers": { "anyOf": [ { "items": { "anyOf": [ { "type": "string" }, { "pattern": "\\{\\{[\\s\\S]+\\}\\}", "type": "string" } ] }, "type": "array" }, { "pattern": "^\\{\\{[\\s\\S]+\\}\\}$", "type": "string" } ] }, "departments": { "anyOf": [ { "items": { "anyOf": [ { "type": "string" }, { "pattern": "\\{\\{[\\s\\S]+\\}\\}", "type": "string" } ] }, "type": "array" }, { "pattern": "^\\{\\{[\\s\\S]+\\}\\}$", "type": "string" } ] }, "network_segments": { "anyOf": [ { "items": { "anyOf": [ { "type": "string" }, { "pattern": "\\{\\{[\\s\\S]+\\}\\}", "type": "string" } ] }, "type": "array" }, { "pattern": "^\\{\\{[\\s\\S]+\\}\\}$", "type": "string" } ] } }, "propertyNames": { "not": { "pattern": "\\{\\{" } }, "type": "object" }, { "pattern": "^\\{\\{[\\s\\S]+\\}\\}$", "type": "string" } ] }, "limitations": { "anyOf": [ { "additionalProperties": false, "properties": { "network_segments": { "anyOf": [ { "items": { "anyOf": [ { "type": "string" }, { "pattern": "\\{\\{[\\s\\S]+\\}\\}", "type": "string" } ] }, "type": "array" }, { "pattern": "^\\{\\{[\\s\\S]+\\}\\}$", "type": "string" } ] } }, "propertyNames": { "not": { "pattern": "\\{\\{" } }, "type": "object" }, { "pattern": "^\\{\\{[\\s\\S]+\\}\\}$", "type": "string" } ] } }, "propertyNames": { "not": { "pattern": "\\{\\{" } }, "type": "object" }, { "pattern": "^\\{\\{[\\s\\S]+\\}\\}$", "type": "string" } ], "description": "Scope objects named exactly as in Jamf. Each name must match exactly one object, and supplied lists replace their collections." } }, "propertyNames": { "not": { "pattern": "\\{\\{" } }, "type": "object" }, { "pattern": "^\\{\\{[\\s\\S]+\\}\\}$", "type": "string" } ], "description": "Patch policy found by name within the title, where the name defaults to the software name. It is updated in place, or created disabled and unscoped before the declared settings are applied. The title's definitions supply the apps it quits and its minimum OS." }, "title": { "anyOf": [ { "minLength": 1, "type": "string" }, { "pattern": "\\{\\{[\\s\\S]+\\}\\}", "type": "string" } ], "description": "Display name of an existing patch software title. It must match exactly one title. Until the title defines the target version, the package link, the policy's target version and a new policy wait for it." }, "version": { "anyOf": [ { "minLength": 1, "type": "string" }, { "pattern": "\\{\\{[\\s\\S]+\\}\\}", "type": "string" } ], "description": "Version defined by the patch title. Defaults to the artifact's managed version. Set this when the title uses a different version or the artifact has no managed version. It only selects the patch title association and policy target; the artifact's version and filename stay unchanged." } }, "propertyNames": { "not": { "pattern": "\\{\\{" } }, "required": [ "title" ], "type": "object" }, { "pattern": "^\\{\\{[\\s\\S]+\\}\\}$", "type": "string" } ], "description": "Link the current package to an existing patch title and optionally manage its policy. Missing version definitions defer the link and target version; other settings on an existing policy still apply. Omitted fields remain unchanged and supplied scope lists replace their collections." }, "policies": { "anyOf": [ { "items": { "anyOf": [ { "additionalProperties": false, "properties": { "category": { "anyOf": [ { "anyOf": [ { "minLength": 1, "type": "string" }, { "type": "null" } ] }, { "pattern": "^\\{\\{[\\s\\S]+\\}\\}$", "type": "string" } ], "description": "Category name for the policy, or null for none. Defaults to the package category." }, "enabled": { "anyOf": [ { "type": "boolean" }, { "pattern": "^\\{\\{[\\s\\S]+\\}\\}$", "type": "string" } ], "description": "Enable the policy. A policy Stemma creates starts disabled." }, "event": { "anyOf": [ { "type": "string" }, { "pattern": "\\{\\{[\\s\\S]+\\}\\}", "type": "string" } ], "description": "Custom event that runs the policy, as in jamf policy -event NAME. An empty string removes it." }, "frequency": { "anyOf": [ { "enum": [ "once_per_computer", "once_per_user_per_computer", "once_per_user", "once_every_day", "once_every_week", "once_every_month", "ongoing" ], "type": "string" }, { "pattern": "\\{\\{[\\s\\S]+\\}\\}", "type": "string" } ], "description": "How often the policy runs on a computer. A policy that runs once per computer leaves Self Service after it runs, so a Self Service policy usually runs ongoing." }, "name": { "anyOf": [ { "minLength": 1, "type": "string" }, { "pattern": "\\{\\{[\\s\\S]+\\}\\}", "type": "string" } ], "description": "Policy name, which finds the policy. Renaming a policy creates another one and leaves the old one in Jamf." }, "retries": { "anyOf": [ { "maximum": 10, "minimum": 0, "type": "integer" }, { "pattern": "^\\{\\{[\\s\\S]+\\}\\}$", "type": "string" } ], "description": "Retry a failed run at the next check-in, up to this many times; it needs frequency: once_per_computer. Zero turns retries off." }, "scope": { "anyOf": [ { "additionalProperties": false, "properties": { "all_computers": { "anyOf": [ { "type": "boolean" }, { "pattern": "^\\{\\{[\\s\\S]+\\}\\}$", "type": "string" } ] }, "buildings": { "anyOf": [ { "items": { "anyOf": [ { "type": "string" }, { "pattern": "\\{\\{[\\s\\S]+\\}\\}", "type": "string" } ] }, "type": "array" }, { "pattern": "^\\{\\{[\\s\\S]+\\}\\}$", "type": "string" } ] }, "computer_groups": { "anyOf": [ { "items": { "anyOf": [ { "type": "string" }, { "pattern": "\\{\\{[\\s\\S]+\\}\\}", "type": "string" } ] }, "type": "array" }, { "pattern": "^\\{\\{[\\s\\S]+\\}\\}$", "type": "string" } ] }, "computers": { "anyOf": [ { "items": { "anyOf": [ { "type": "string" }, { "pattern": "\\{\\{[\\s\\S]+\\}\\}", "type": "string" } ] }, "type": "array" }, { "pattern": "^\\{\\{[\\s\\S]+\\}\\}$", "type": "string" } ] }, "departments": { "anyOf": [ { "items": { "anyOf": [ { "type": "string" }, { "pattern": "\\{\\{[\\s\\S]+\\}\\}", "type": "string" } ] }, "type": "array" }, { "pattern": "^\\{\\{[\\s\\S]+\\}\\}$", "type": "string" } ] }, "exclusions": { "anyOf": [ { "additionalProperties": false, "properties": { "buildings": { "anyOf": [ { "items": { "anyOf": [ { "type": "string" }, { "pattern": "\\{\\{[\\s\\S]+\\}\\}", "type": "string" } ] }, "type": "array" }, { "pattern": "^\\{\\{[\\s\\S]+\\}\\}$", "type": "string" } ] }, "computer_groups": { "anyOf": [ { "items": { "anyOf": [ { "type": "string" }, { "pattern": "\\{\\{[\\s\\S]+\\}\\}", "type": "string" } ] }, "type": "array" }, { "pattern": "^\\{\\{[\\s\\S]+\\}\\}$", "type": "string" } ] }, "computers": { "anyOf": [ { "items": { "anyOf": [ { "type": "string" }, { "pattern": "\\{\\{[\\s\\S]+\\}\\}", "type": "string" } ] }, "type": "array" }, { "pattern": "^\\{\\{[\\s\\S]+\\}\\}$", "type": "string" } ] }, "departments": { "anyOf": [ { "items": { "anyOf": [ { "type": "string" }, { "pattern": "\\{\\{[\\s\\S]+\\}\\}", "type": "string" } ] }, "type": "array" }, { "pattern": "^\\{\\{[\\s\\S]+\\}\\}$", "type": "string" } ] }, "network_segments": { "anyOf": [ { "items": { "anyOf": [ { "type": "string" }, { "pattern": "\\{\\{[\\s\\S]+\\}\\}", "type": "string" } ] }, "type": "array" }, { "pattern": "^\\{\\{[\\s\\S]+\\}\\}$", "type": "string" } ] } }, "propertyNames": { "not": { "pattern": "\\{\\{" } }, "type": "object" }, { "pattern": "^\\{\\{[\\s\\S]+\\}\\}$", "type": "string" } ] }, "limitations": { "anyOf": [ { "additionalProperties": false, "properties": { "network_segments": { "anyOf": [ { "items": { "anyOf": [ { "type": "string" }, { "pattern": "\\{\\{[\\s\\S]+\\}\\}", "type": "string" } ] }, "type": "array" }, { "pattern": "^\\{\\{[\\s\\S]+\\}\\}$", "type": "string" } ] } }, "propertyNames": { "not": { "pattern": "\\{\\{" } }, "type": "object" }, { "pattern": "^\\{\\{[\\s\\S]+\\}\\}$", "type": "string" } ] } }, "propertyNames": { "not": { "pattern": "\\{\\{" } }, "type": "object" }, { "pattern": "^\\{\\{[\\s\\S]+\\}\\}$", "type": "string" } ], "description": "Scope objects named exactly as in Jamf. Each name must match exactly one object, and supplied lists replace their collections." }, "self_service": { "anyOf": [ { "anyOf": [ { "type": "boolean" }, { "additionalProperties": false, "properties": { "category": { "anyOf": [ { "anyOf": [ { "minLength": 1, "type": "string" }, { "type": "null" } ] }, { "pattern": "^\\{\\{[\\s\\S]+\\}\\}$", "type": "string" } ], "description": "Self Service category name, or null for none. Defaults to the package category." }, "description": { "anyOf": [ { "type": "string" }, { "pattern": "\\{\\{[\\s\\S]+\\}\\}", "type": "string" } ], "description": "Description shown in Self Service, in Markdown. An empty string clears it." }, "display_name": { "anyOf": [ { "minLength": 1, "type": "string" }, { "pattern": "\\{\\{[\\s\\S]+\\}\\}", "type": "string" } ], "description": "Name shown in Self Service. Defaults to the selected application's name, else the software name." }, "featured": { "anyOf": [ { "type": "boolean" }, { "pattern": "^\\{\\{[\\s\\S]+\\}\\}$", "type": "string" } ], "description": "Feature the item on the Self Service home page." } }, "propertyNames": { "not": { "pattern": "\\{\\{" } }, "type": "object" } ] }, { "pattern": "^\\{\\{[\\s\\S]+\\}\\}$", "type": "string" } ], "description": "Offer the policy in Self Service: true, false, or its Self Service settings." }, "triggers": { "anyOf": [ { "items": { "anyOf": [ { "enum": [ "checkin", "enrollment_complete", "login", "startup", "network_state_change" ], "type": "string" }, { "pattern": "\\{\\{[\\s\\S]+\\}\\}", "type": "string" } ] }, "type": "array", "uniqueItems": true }, { "pattern": "^\\{\\{[\\s\\S]+\\}\\}$", "type": "string" } ], "description": "Events that run the policy automatically: recurring check-in, enrollment complete, login, startup or a network state change. With none, the policy runs from Self Service or its custom event." }, "update_inventory": { "anyOf": [ { "type": "boolean" }, { "pattern": "^\\{\\{[\\s\\S]+\\}\\}$", "type": "string" } ], "description": "Update inventory after the policy runs. A policy Stemma creates updates inventory." } }, "propertyNames": { "not": { "pattern": "\\{\\{" } }, "required": [ "name" ], "type": "object" }, { "pattern": "^\\{\\{[\\s\\S]+\\}\\}$", "type": "string" } ] }, "type": "array" }, { "pattern": "^\\{\\{[\\s\\S]+\\}\\}$", "type": "string" } ], "description": "Install the current package through named policies. Existing policies are updated in place; new policies start disabled and unscoped. Omitted settings remain unchanged." }, "priority": { "anyOf": [ { "type": "integer" }, { "pattern": "^\\{\\{[\\s\\S]+\\}\\}$", "type": "string" } ], "description": "Installation order among packages installed together; lower values install first. Defaults to 10 when creating a package." }, "reboot_required": { "anyOf": [ { "type": "boolean" }, { "pattern": "^\\{\\{[\\s\\S]+\\}\\}$", "type": "string" } ], "description": "Require a restart after installation. Explicit false is managed." }, "retention": { "anyOf": [ { "additionalProperties": false, "properties": { "keep": { "anyOf": [ { "minimum": 1, "type": "integer" }, { "pattern": "^\\{\\{[\\s\\S]+\\}\\}$", "type": "string" } ], "description": "Number of versions to retain, including the current publication. Keeps the current version and the N-1 newest others; versions protected by native references also remain." } }, "propertyNames": { "not": { "pattern": "\\{\\{" } }, "required": [ "keep" ], "type": "object" }, { "pattern": "^\\{\\{[\\s\\S]+\\}\\}$", "type": "string" } ], "description": "Keep the current package and the N-1 newest others carrying this software's identity marker, ordered by numeric package ID, and delete the rest. A package that a policy, PreStage or patch title still references is kept, and nothing is deleted while those references cannot be read." } }, "propertyNames": { "not": { "pattern": "\\{\\{" } }, "type": "object" }, "OperationMetadata_munki": { "$id": "https://stemma.invalid/editor/munki/metadata", "$schema": "https://json-schema.org/draft/2020-12/schema", "additionalProperties": false, "properties": { "inputs": { "additionalProperties": { "description": "Named output from this resource. Defaults to installer.", "pattern": "^[A-Za-z0-9][A-Za-z0-9._-]{0,127}$", "type": "string" }, "propertyNames": { "pattern": "^[A-Za-z0-9][A-Za-z0-9._-]{0,127}$" }, "type": "object" }, "installer": { "description": "Named output from this resource. Defaults to installer.", "pattern": "^[A-Za-z0-9][A-Za-z0-9._-]{0,127}$", "type": "string" }, "pkginfo": { "$schema": "https://json-schema.org/draft/2020-12/schema", "anyOf": [ { "additionalProperties": false, "properties": { "OnDemand": { "anyOf": [ { "type": "boolean" }, { "pattern": "^\\{\\{[\\s\\S]+\\}\\}$", "type": "string" } ], "description": "Allow repeated optional installation even when the item is already installed." }, "RestartAction": { "anyOf": [ { "type": "string" }, { "pattern": "\\{\\{[\\s\\S]+\\}\\}", "type": "string" } ], "description": "Munki restart or logout requirement after installation." }, "autoremove": { "anyOf": [ { "type": "boolean" }, { "pattern": "^\\{\\{[\\s\\S]+\\}\\}$", "type": "string" } ], "description": "Remove installed software when no applicable manifest requests it." }, "blocking_applications": { "anyOf": [ { "items": { "anyOf": [ { "type": "string" }, { "pattern": "\\{\\{[\\s\\S]+\\}\\}", "type": "string" } ] }, "type": "array" }, { "pattern": "^\\{\\{[\\s\\S]+\\}\\}$", "type": "string" } ], "description": "Applications that block installation or removal while they run. Munki uses the applications in installs when this is absent; an empty list blocks nothing." }, "catalogs": { "anyOf": [ { "items": { "anyOf": [ { "type": "string" }, { "pattern": "\\{\\{[\\s\\S]+\\}\\}", "type": "string" } ] }, "type": "array" }, { "pattern": "^\\{\\{[\\s\\S]+\\}\\}$", "type": "string" } ], "description": "Complete catalog membership. An empty list removes all memberships." }, "category": { "anyOf": [ { "anyOf": [ { "description": "Managed Software Center category. Null clears the category.", "type": "string" }, { "type": "null" } ] }, { "pattern": "^\\{\\{[\\s\\S]+\\}\\}$", "type": "string" } ], "description": "Managed Software Center category. Null clears the category." }, "description": { "anyOf": [ { "anyOf": [ { "description": "Application description. Omission preserves the remote value; null clears it.", "type": "string" }, { "type": "null" } ] }, { "pattern": "^\\{\\{[\\s\\S]+\\}\\}$", "type": "string" } ], "description": "Application description. Omission preserves the remote value; null clears it." }, "developer": { "anyOf": [ { "anyOf": [ { "description": "Software publisher display name. Null clears the publisher.", "type": "string" }, { "type": "null" } ] }, { "pattern": "^\\{\\{[\\s\\S]+\\}\\}$", "type": "string" } ], "description": "Software publisher display name. Null clears the publisher." }, "display_name": { "anyOf": [ { "anyOf": [ { "description": "Optional display title. Omission preserves the remote title; null clears it.", "type": "string" }, { "type": "null" } ] }, { "pattern": "^\\{\\{[\\s\\S]+\\}\\}$", "type": "string" } ], "description": "Optional display title. Omission preserves the remote title; null clears it." }, "icon_hash": { "anyOf": [ { "anyOf": [ { "description": "SHA-256 of the selected repository icon. Null clears it.", "type": "string" }, { "type": "null" } ] }, { "pattern": "^\\{\\{[\\s\\S]+\\}\\}$", "type": "string" } ], "description": "SHA-256 of the selected repository icon. Null clears it." }, "icon_name": { "anyOf": [ { "anyOf": [ { "description": "Relative image path in the repository icons directory. Null clears it.", "type": "string" }, { "type": "null" } ] }, { "pattern": "^\\{\\{[\\s\\S]+\\}\\}$", "type": "string" } ], "description": "Relative image path in the repository icons directory. Null clears it." }, "installable_condition": { "anyOf": [ { "type": "string" }, { "pattern": "\\{\\{[\\s\\S]+\\}\\}", "type": "string" } ], "description": "Munki predicate controlling installation eligibility." }, "installcheck_script": { "anyOf": [ { "type": "string" }, { "pattern": "\\{\\{[\\s\\S]+\\}\\}", "type": "string" } ], "description": "Deployment-time installation check script. Never executed by Stemma." }, "installed_size": { "anyOf": [ { "type": "integer" }, { "pattern": "^\\{\\{[\\s\\S]+\\}\\}$", "type": "string" } ], "description": "Installed size in KiB; independent of downloaded installer size." }, "installer_type": { "anyOf": [ { "enum": [ "pkg", "copy_from_dmg", "nopkg" ], "type": "string" }, { "pattern": "\\{\\{[\\s\\S]+\\}\\}", "type": "string" } ], "description": "Preserve a vendor PKG, select items in an existing DMG, or publish a script-only item. PKG is inferred only from a .pkg payload." }, "installs": { "anyOf": [ { "items": { "anyOf": [ { "anyOf": [ { "additionalProperties": false, "properties": { "CFBundleIdentifier": { "anyOf": [ { "type": "string" }, { "pattern": "\\{\\{[\\s\\S]+\\}\\}", "type": "string" } ] }, "CFBundleName": { "anyOf": [ { "type": "string" }, { "pattern": "\\{\\{[\\s\\S]+\\}\\}", "type": "string" } ] }, "CFBundleShortVersionString": { "anyOf": [ { "type": "string" }, { "pattern": "\\{\\{[\\s\\S]+\\}\\}", "type": "string" } ] }, "CFBundleVersion": { "anyOf": [ { "type": "string" }, { "pattern": "\\{\\{[\\s\\S]+\\}\\}", "type": "string" } ] }, "installer_item_location": { "anyOf": [ { "type": "string" }, { "pattern": "\\{\\{[\\s\\S]+\\}\\}", "type": "string" } ] }, "md5checksum": { "anyOf": [ { "type": "string" }, { "pattern": "\\{\\{[\\s\\S]+\\}\\}", "type": "string" } ] }, "minimum_update_version": { "anyOf": [ { "type": "string" }, { "pattern": "\\{\\{[\\s\\S]+\\}\\}", "type": "string" } ] }, "minosversion": { "anyOf": [ { "type": "string" }, { "pattern": "\\{\\{[\\s\\S]+\\}\\}", "type": "string" } ] }, "path": { "anyOf": [ { "type": "string" }, { "pattern": "\\{\\{[\\s\\S]+\\}\\}", "type": "string" } ] }, "type": { "anyOf": [ { "type": "string" }, { "pattern": "\\{\\{[\\s\\S]+\\}\\}", "type": "string" } ] }, "version_comparison_key": { "anyOf": [ { "type": "string" }, { "pattern": "\\{\\{[\\s\\S]+\\}\\}", "type": "string" } ] } }, "propertyNames": { "not": { "pattern": "\\{\\{" } }, "type": "object" }, { "additionalProperties": true, "propertyNames": { "not": { "pattern": "\\{\\{" } }, "required": [ "kind" ], "type": "object" } ] }, { "pattern": "^\\{\\{[\\s\\S]+\\}\\}$", "type": "string" } ] }, "type": "array" }, { "pattern": "^\\{\\{[\\s\\S]+\\}\\}$", "type": "string" } ], "description": "Complete native detection list using application or bundle or plist or file entries. An item can instead be an inspected application, written as an expression such as {{ facts.name }}, which is detected at its installed path by its bundle identifier and version." }, "items_to_copy": { "anyOf": [ { "items": { "anyOf": [ { "additionalProperties": false, "properties": { "destination_item": { "anyOf": [ { "type": "string" }, { "pattern": "\\{\\{[\\s\\S]+\\}\\}", "type": "string" } ] }, "destination_path": { "anyOf": [ { "type": "string" }, { "pattern": "\\{\\{[\\s\\S]+\\}\\}", "type": "string" } ] }, "group": { "anyOf": [ { "type": "string" }, { "pattern": "\\{\\{[\\s\\S]+\\}\\}", "type": "string" } ] }, "mode": { "anyOf": [ { "type": "string" }, { "pattern": "\\{\\{[\\s\\S]+\\}\\}", "type": "string" } ] }, "source_item": { "anyOf": [ { "type": "string" }, { "pattern": "\\{\\{[\\s\\S]+\\}\\}", "type": "string" } ] }, "user": { "anyOf": [ { "type": "string" }, { "pattern": "\\{\\{[\\s\\S]+\\}\\}", "type": "string" } ] } }, "propertyNames": { "not": { "pattern": "\\{\\{" } }, "type": "object" }, { "pattern": "^\\{\\{[\\s\\S]+\\}\\}$", "type": "string" } ] }, "type": "array" }, { "pattern": "^\\{\\{[\\s\\S]+\\}\\}$", "type": "string" } ], "description": "Payload selections and destination paths for copy_from_dmg." }, "maximum_os_version": { "anyOf": [ { "type": "string" }, { "pattern": "\\{\\{[\\s\\S]+\\}\\}", "type": "string" } ], "description": "Highest macOS version eligible for this package." }, "minimum_munki_version": { "anyOf": [ { "type": "string" }, { "pattern": "\\{\\{[\\s\\S]+\\}\\}", "type": "string" } ], "description": "Lowest Munki client version eligible for this package." }, "name": { "anyOf": [ { "type": "string" }, { "pattern": "\\{\\{[\\s\\S]+\\}\\}", "type": "string" } ], "description": "Stable native Munki name. Defaults to the software name when creating a package." }, "notes": { "anyOf": [ { "type": "string" }, { "pattern": "\\{\\{[\\s\\S]+\\}\\}", "type": "string" } ], "description": "Administrator notes retained in pkginfo." }, "package_path": { "anyOf": [ { "type": "string" }, { "pattern": "\\{\\{[\\s\\S]+\\}\\}", "type": "string" } ], "description": "Relative package path within the original installer image." }, "postinstall_script": { "anyOf": [ { "type": "string" }, { "pattern": "\\{\\{[\\s\\S]+\\}\\}", "type": "string" } ], "description": "Deployment-time script after installation. Never executed by Stemma." }, "postuninstall_script": { "anyOf": [ { "type": "string" }, { "pattern": "\\{\\{[\\s\\S]+\\}\\}", "type": "string" } ], "description": "Deployment-time script after removal. Never executed by Stemma." }, "precache": { "anyOf": [ { "type": "boolean" }, { "pattern": "^\\{\\{[\\s\\S]+\\}\\}$", "type": "string" } ], "description": "Cache the installer before it is requested for installation." }, "preinstall_script": { "anyOf": [ { "type": "string" }, { "pattern": "\\{\\{[\\s\\S]+\\}\\}", "type": "string" } ], "description": "Deployment-time script before installation. Never executed by Stemma." }, "preuninstall_script": { "anyOf": [ { "type": "string" }, { "pattern": "\\{\\{[\\s\\S]+\\}\\}", "type": "string" } ], "description": "Deployment-time script before removal. Never executed by Stemma." }, "receipts": { "anyOf": [ { "items": { "anyOf": [ { "additionalProperties": false, "properties": { "installed_size": { "anyOf": [ { "type": "integer" }, { "pattern": "^\\{\\{[\\s\\S]+\\}\\}$", "type": "string" } ] }, "name": { "anyOf": [ { "type": "string" }, { "pattern": "\\{\\{[\\s\\S]+\\}\\}", "type": "string" } ] }, "optional": { "anyOf": [ { "type": "boolean" }, { "pattern": "^\\{\\{[\\s\\S]+\\}\\}$", "type": "string" } ] }, "packageid": { "anyOf": [ { "type": "string" }, { "pattern": "\\{\\{[\\s\\S]+\\}\\}", "type": "string" } ] }, "version": { "anyOf": [ { "type": "string" }, { "pattern": "\\{\\{[\\s\\S]+\\}\\}", "type": "string" } ] } }, "propertyNames": { "not": { "pattern": "\\{\\{" } }, "type": "object" }, { "pattern": "^\\{\\{[\\s\\S]+\\}\\}$", "type": "string" } ] }, "type": "array" }, { "pattern": "^\\{\\{[\\s\\S]+\\}\\}$", "type": "string" } ], "description": "Complete Apple package receipt list used for detection and removal." }, "requires": { "anyOf": [ { "items": { "anyOf": [ { "oneOf": [ { "type": "string" }, { "$schema": "https://json-schema.org/draft/2020-12/schema", "additionalProperties": false, "properties": { "resource": { "anyOf": [ { "additionalProperties": false, "properties": { "apiVersion": { "anyOf": [ { "type": "string" }, { "pattern": "\\{\\{[\\s\\S]+\\}\\}", "type": "string" } ], "default": "stemma/v1alpha1" }, "kind": { "anyOf": [ { "minLength": 1, "type": "string" }, { "pattern": "\\{\\{[\\s\\S]+\\}\\}", "type": "string" } ] }, "name": { "anyOf": [ { "minLength": 1, "type": "string" }, { "pattern": "\\{\\{[\\s\\S]+\\}\\}", "type": "string" } ] } }, "propertyNames": { "not": { "pattern": "\\{\\{" } }, "required": [ "kind", "name" ], "type": "object" }, { "pattern": "^\\{\\{[\\s\\S]+\\}\\}$", "type": "string" } ] }, "version": { "anyOf": [ { "type": "string" }, { "pattern": "\\{\\{[\\s\\S]+\\}\\}", "type": "string" } ] } }, "propertyNames": { "not": { "pattern": "\\{\\{" } }, "required": [ "resource" ], "type": "object" } ] }, { "pattern": "^\\{\\{[\\s\\S]+\\}\\}$", "type": "string" } ] }, "type": "array" }, { "pattern": "^\\{\\{[\\s\\S]+\\}\\}$", "type": "string" } ], "description": "Complete list of Munki item dependencies. Entries are native item names, optionally with version requirements; [] clears the list." }, "supported_architectures": { "anyOf": [ { "items": { "anyOf": [ { "type": "string" }, { "pattern": "\\{\\{[\\s\\S]+\\}\\}", "type": "string" } ] }, "type": "array" }, { "pattern": "^\\{\\{[\\s\\S]+\\}\\}$", "type": "string" } ], "description": "Complete architecture list using arm64 or x86_64." }, "unattended_install": { "anyOf": [ { "type": "boolean" }, { "pattern": "^\\{\\{[\\s\\S]+\\}\\}$", "type": "string" } ], "description": "Permit installation without interaction. Explicit false disables it." }, "unattended_uninstall": { "anyOf": [ { "type": "boolean" }, { "pattern": "^\\{\\{[\\s\\S]+\\}\\}$", "type": "string" } ], "description": "Permit removal without interaction. Explicit false disables it." }, "uninstall_method": { "anyOf": [ { "type": "string" }, { "pattern": "\\{\\{[\\s\\S]+\\}\\}", "type": "string" } ], "description": "Supported native removal method; requires its corresponding receipts or copy entries or script." }, "uninstall_script": { "anyOf": [ { "type": "string" }, { "pattern": "\\{\\{[\\s\\S]+\\}\\}", "type": "string" } ], "description": "Deployment-time removal script. Never executed by Stemma." }, "uninstallable": { "anyOf": [ { "type": "boolean" }, { "pattern": "^\\{\\{[\\s\\S]+\\}\\}$", "type": "string" } ], "description": "Expose supported removal using uninstall_method." }, "uninstallcheck_script": { "anyOf": [ { "type": "string" }, { "pattern": "\\{\\{[\\s\\S]+\\}\\}", "type": "string" } ], "description": "Deployment-time removal check script. Never executed by Stemma." }, "update_for": { "anyOf": [ { "items": { "anyOf": [ { "oneOf": [ { "type": "string" }, { "$schema": "https://json-schema.org/draft/2020-12/schema", "additionalProperties": false, "properties": { "resource": { "anyOf": [ { "additionalProperties": false, "properties": { "apiVersion": { "anyOf": [ { "type": "string" }, { "pattern": "\\{\\{[\\s\\S]+\\}\\}", "type": "string" } ], "default": "stemma/v1alpha1" }, "kind": { "anyOf": [ { "minLength": 1, "type": "string" }, { "pattern": "\\{\\{[\\s\\S]+\\}\\}", "type": "string" } ] }, "name": { "anyOf": [ { "minLength": 1, "type": "string" }, { "pattern": "\\{\\{[\\s\\S]+\\}\\}", "type": "string" } ] } }, "propertyNames": { "not": { "pattern": "\\{\\{" } }, "required": [ "kind", "name" ], "type": "object" }, { "pattern": "^\\{\\{[\\s\\S]+\\}\\}$", "type": "string" } ] }, "version": { "anyOf": [ { "type": "string" }, { "pattern": "\\{\\{[\\s\\S]+\\}\\}", "type": "string" } ] } }, "propertyNames": { "not": { "pattern": "\\{\\{" } }, "required": [ "resource" ], "type": "object" } ] }, { "pattern": "^\\{\\{[\\s\\S]+\\}\\}$", "type": "string" } ] }, "type": "array" }, { "pattern": "^\\{\\{[\\s\\S]+\\}\\}$", "type": "string" } ], "description": "Complete list of Munki items this item updates. Entries are native item names, optionally with version requirements; [] clears the list." }, "version": { "anyOf": [ { "type": "string" }, { "pattern": "\\{\\{[\\s\\S]+\\}\\}", "type": "string" } ], "description": "Explicit native content version. Omit to derive a version from the inspected artifact." }, "version_script": { "anyOf": [ { "type": "string" }, { "pattern": "\\{\\{[\\s\\S]+\\}\\}", "type": "string" } ], "description": "Deployment-time installed-version script. Never executed by Stemma." } }, "propertyNames": { "not": { "pattern": "\\{\\{" } }, "type": "object" }, { "pattern": "^\\{\\{[\\s\\S]+\\}\\}$", "type": "string" } ], "description": "Native Munki metadata. Omitted fields are left unchanged unless derivation owns them; explicit lists own the whole collection." }, "retention": { "anyOf": [ { "additionalProperties": false, "properties": { "keep": { "anyOf": [ { "minimum": 1, "type": "integer" }, { "pattern": "^\\{\\{[\\s\\S]+\\}\\}$", "type": "string" } ], "description": "Number of versions to retain, including the current publication. Keeps the current version and the N-1 newest others; versions protected by native references also remain." } }, "propertyNames": { "not": { "pattern": "\\{\\{" } }, "type": "object" }, { "pattern": "^\\{\\{[\\s\\S]+\\}\\}$", "type": "string" } ], "description": "Keep the current item and newest other versions. Exact version references are protected; bare references protect older items with different catalogs or installation constraints." } }, "propertyNames": { "not": { "pattern": "\\{\\{" } }, "type": "object" }, "PartialInput": { "$id": "https://stemma.invalid/editor/partial-input", "anyOf": [ { "additionalProperties": false, "properties": { "resource": { "additionalProperties": false, "description": "Use a named output from another resource in this project.", "properties": { "apiVersion": { "default": "stemma/v1alpha1", "not": { "pattern": "\\{\\{" }, "type": "string" }, "kind": { "minLength": 1, "not": { "pattern": "\\{\\{" }, "type": "string" }, "name": { "minLength": 1, "not": { "pattern": "\\{\\{" }, "type": "string" }, "output": { "default": "installer", "not": { "pattern": "\\{\\{" }, "type": "string" } }, "type": "object" } }, "type": "object" }, { "additionalProperties": false, "properties": { "filename": { "anyOf": [ { "type": "string" }, { "pattern": "\\{\\{[\\s\\S]+\\}\\}", "type": "string" } ], "description": "Optional input basename override. Defaults to the selected path's basename. Independent of publication naming." }, "path": { "anyOf": [ { "minLength": 1, "type": "string" }, { "pattern": "\\{\\{[\\s\\S]+\\}\\}", "type": "string" } ], "description": "Exact file or directory path. Relative paths resolve from the resource file; absolute paths select a host location." }, "sha256": { "anyOf": [ { "type": "string" }, { "pattern": "\\{\\{[\\s\\S]+\\}\\}", "type": "string" } ], "description": "Optional expected SHA-256 content digest, as 64 lowercase hexadecimal characters." } }, "propertyNames": { "not": { "pattern": "\\{\\{" } }, "type": "object" }, { "additionalProperties": false, "properties": { "filename": { "anyOf": [ { "type": "string" }, { "pattern": "\\{\\{[\\s\\S]+\\}\\}", "type": "string" } ], "description": "Optional input basename override. Defaults to the selected path's basename. Independent of publication naming." }, "path": { "anyOf": [ { "minLength": 1, "type": "string" }, { "pattern": "\\{\\{[\\s\\S]+\\}\\}", "type": "string" } ], "description": "Exact file or directory path. Relative paths resolve from the resource file; absolute paths select a host location." }, "resolver": { "const": "file", "description": "Built-in resolver selecting this input." }, "sha256": { "anyOf": [ { "type": "string" }, { "pattern": "\\{\\{[\\s\\S]+\\}\\}", "type": "string" } ], "description": "Optional expected SHA-256 content digest, as 64 lowercase hexadecimal characters." } }, "propertyNames": { "not": { "pattern": "\\{\\{" } }, "type": "object" }, { "additionalProperties": false, "properties": { "asset": { "anyOf": [ { "minLength": 1, "type": "string" }, { "pattern": "\\{\\{[\\s\\S]+\\}\\}", "type": "string" } ], "description": "GitHub asset-name glob using doublestar semantics. Must match exactly one release asset; exact names also work." }, "filename": { "anyOf": [ { "type": "string" }, { "pattern": "\\{\\{[\\s\\S]+\\}\\}", "type": "string" } ], "description": "Optional input basename override. Defaults to the selected asset name. Independent of publication naming." }, "include_prereleases": { "anyOf": [ { "type": "boolean" }, { "pattern": "^\\{\\{[\\s\\S]+\\}\\}$", "type": "string" } ], "description": "Include prereleases when discovering latest or a tag glob; select the newest published non-draft release. Explicit release tags are unchanged." }, "release": { "anyOf": [ { "type": "string" }, { "pattern": "\\{\\{[\\s\\S]+\\}\\}", "type": "string" } ], "description": "GitHub release tag, tag glob, or latest. Omitted or empty values select latest. A value containing *, ? or [ selects the newest published release whose tag matches, using doublestar semantics." }, "repository": { "anyOf": [ { "minLength": 1, "type": "string" }, { "pattern": "\\{\\{[\\s\\S]+\\}\\}", "type": "string" } ], "description": "GitHub repository in owner/name form." }, "resolver": { "const": "github", "description": "Built-in resolver selecting this input." }, "sha256": { "anyOf": [ { "type": "string" }, { "pattern": "\\{\\{[\\s\\S]+\\}\\}", "type": "string" } ], "description": "Optional expected SHA-256 content digest, as 64 lowercase hexadecimal characters." }, "token": { "anyOf": [ { "type": "string" }, { "pattern": "\\{\\{[\\s\\S]+\\}\\}", "type": "string" } ], "description": "Optional bearer token for release discovery and acquisition. Without one, discovery uses GH_TOKEN, then GITHUB_TOKEN, from the environment.", "writeOnly": true } }, "propertyNames": { "not": { "pattern": "\\{\\{" } }, "type": "object" }, { "additionalProperties": false, "anyOf": [ { "not": { "required": [ "formula" ] } }, { "not": { "required": [ "cask" ] } } ], "properties": { "architecture": { "anyOf": [ { "enum": [ "arm64", "x86_64" ], "type": "string" }, { "pattern": "\\{\\{[\\s\\S]+\\}\\}", "type": "string" } ], "description": "Target architecture. Defaults to arm64, independently of the runner." }, "cask": { "anyOf": [ { "type": "string" }, { "pattern": "\\{\\{[\\s\\S]+\\}\\}", "type": "string" } ], "description": "Homebrew cask token. Selects its vendor download; no cask actions run." }, "formula": { "anyOf": [ { "type": "string" }, { "pattern": "\\{\\{[\\s\\S]+\\}\\}", "type": "string" } ], "description": "Homebrew core formula token. Selects a standalone bottle requiring no relocation, runtime formula dependencies or post-install actions. No source-build fallback." }, "language": { "anyOf": [ { "type": "string" }, { "pattern": "\\{\\{[\\s\\S]+\\}\\}", "type": "string" } ], "description": "Cask language alias. Omit for the cask's declared default language." }, "macos": { "anyOf": [ { "type": "string" }, { "pattern": "\\{\\{[\\s\\S]+\\}\\}", "type": "string" } ], "description": "Target macOS major version. Omit for the current supported release (27). Update locks the concrete target and selected variant." }, "resolver": { "const": "homebrew", "description": "Built-in resolver selecting this input." } }, "propertyNames": { "not": { "pattern": "\\{\\{" } }, "type": "object" }, { "additionalProperties": false, "properties": { "filename": { "anyOf": [ { "type": "string" }, { "pattern": "\\{\\{[\\s\\S]+\\}\\}", "type": "string" } ], "description": "Optional input basename override. Defaults to Content-Disposition, then final and original URL basenames. Independent of publication naming." }, "headers": { "anyOf": [ { "additionalProperties": { "anyOf": [ { "type": "string" }, { "pattern": "\\{\\{[\\s\\S]+\\}\\}", "type": "string" } ] }, "propertyNames": { "not": { "pattern": "\\{\\{" } }, "type": "object" }, { "pattern": "^\\{\\{[\\s\\S]+\\}\\}$", "type": "string" } ], "description": "HTTP request headers, including optional User-Agent and Referer overrides. Credentials and custom headers are confined to the source origin. Only Accept, Accept-Encoding, Accept-Language and User-Agent participate in source identity; other headers are treated as credentials." }, "match": { "anyOf": [ { "type": "string" }, { "pattern": "\\{\\{[\\s\\S]+\\}\\}", "type": "string" } ], "description": "Download page regular expression whose full matches are URL references resolved against the page's base URL. HTML pages match element attribute values; other pages match the response body. Must identify one distinct stable HTTP(S) download URL. With a named group version capturing dotted numbers, several URLs may match: the highest version selects the URL and becomes the input's version." }, "sha256": { "anyOf": [ { "type": "string" }, { "pattern": "\\{\\{[\\s\\S]+\\}\\}", "type": "string" } ], "description": "Optional expected SHA-256 content digest, as 64 lowercase hexadecimal characters." }, "token": { "anyOf": [ { "type": "string" }, { "pattern": "\\{\\{[\\s\\S]+\\}\\}", "type": "string" } ], "description": "Optional bearer token. Mutually exclusive with an Authorization header.", "writeOnly": true }, "url": { "anyOf": [ { "minLength": 1, "type": "string" }, { "pattern": "\\{\\{[\\s\\S]+\\}\\}", "type": "string" } ], "description": "Stable HTTP download URL. Redirects are followed without retaining temporary URLs in the lockfile." } }, "propertyNames": { "not": { "pattern": "\\{\\{" } }, "type": "object" }, { "additionalProperties": false, "properties": { "filename": { "anyOf": [ { "type": "string" }, { "pattern": "\\{\\{[\\s\\S]+\\}\\}", "type": "string" } ], "description": "Optional input basename override. Defaults to Content-Disposition, then final and original URL basenames. Independent of publication naming." }, "headers": { "anyOf": [ { "additionalProperties": { "anyOf": [ { "type": "string" }, { "pattern": "\\{\\{[\\s\\S]+\\}\\}", "type": "string" } ] }, "propertyNames": { "not": { "pattern": "\\{\\{" } }, "type": "object" }, { "pattern": "^\\{\\{[\\s\\S]+\\}\\}$", "type": "string" } ], "description": "HTTP request headers, including optional User-Agent and Referer overrides. Credentials and custom headers are confined to the source origin. Only Accept, Accept-Encoding, Accept-Language and User-Agent participate in source identity; other headers are treated as credentials." }, "match": { "anyOf": [ { "type": "string" }, { "pattern": "\\{\\{[\\s\\S]+\\}\\}", "type": "string" } ], "description": "Download page regular expression whose full matches are URL references resolved against the page's base URL. HTML pages match element attribute values; other pages match the response body. Must identify one distinct stable HTTP(S) download URL. With a named group version capturing dotted numbers, several URLs may match: the highest version selects the URL and becomes the input's version." }, "resolver": { "const": "http", "description": "Built-in resolver selecting this input." }, "sha256": { "anyOf": [ { "type": "string" }, { "pattern": "\\{\\{[\\s\\S]+\\}\\}", "type": "string" } ], "description": "Optional expected SHA-256 content digest, as 64 lowercase hexadecimal characters." }, "token": { "anyOf": [ { "type": "string" }, { "pattern": "\\{\\{[\\s\\S]+\\}\\}", "type": "string" } ], "description": "Optional bearer token. Mutually exclusive with an Authorization header.", "writeOnly": true }, "url": { "anyOf": [ { "minLength": 1, "type": "string" }, { "pattern": "\\{\\{[\\s\\S]+\\}\\}", "type": "string" } ], "description": "Stable HTTP download URL. Redirects are followed without retaining temporary URLs in the lockfile." } }, "propertyNames": { "not": { "pattern": "\\{\\{" } }, "type": "object" }, { "additionalProperties": false, "properties": { "base": { "anyOf": [ { "type": "string" }, { "pattern": "\\{\\{[\\s\\S]+\\}\\}", "type": "string" } ], "description": "Local tree root, relative to the resource file. Defaults to its directory." }, "filename": { "anyOf": [ { "type": "string" }, { "pattern": "\\{\\{[\\s\\S]+\\}\\}", "type": "string" } ], "description": "Optional input basename override. Defaults to the selected base's basename. Independent of publication naming." }, "include": { "anyOf": [ { "items": { "anyOf": [ { "type": "string" }, { "pattern": "\\{\\{[\\s\\S]+\\}\\}", "type": "string" } ] }, "minItems": 1, "type": "array" }, { "pattern": "^\\{\\{[\\s\\S]+\\}\\}$", "type": "string" } ], "description": "Local tree globs using doublestar semantics. Each pattern must match at least one entry." }, "resolver": { "const": "local", "description": "Built-in resolver selecting this input." }, "sha256": { "anyOf": [ { "type": "string" }, { "pattern": "\\{\\{[\\s\\S]+\\}\\}", "type": "string" } ], "description": "Optional expected SHA-256 content digest, as 64 lowercase hexadecimal characters." } }, "propertyNames": { "not": { "pattern": "\\{\\{" } }, "type": "object" }, { "additionalProperties": false, "properties": { "architecture": { "anyOf": [ { "enum": [ "x64", "x86", "arm64", "arm", "neutral" ], "type": "string" }, { "pattern": "\\{\\{[\\s\\S]+\\}\\}", "type": "string" } ], "description": "Exact target architecture. Defaults to x64 independently of the runner." }, "installer_type": { "anyOf": [ { "type": "string" }, { "pattern": "\\{\\{[\\s\\S]+\\}\\}", "type": "string" } ], "description": "Optional declared installer type filter, such as msi, wix, inno or zip." }, "locale": { "anyOf": [ { "type": "string" }, { "pattern": "\\{\\{[\\s\\S]+\\}\\}", "type": "string" } ], "description": "Optional exact installer locale filter, such as en-US. Package description locale is not an installer locale." }, "package": { "anyOf": [ { "minLength": 1, "type": "string" }, { "pattern": "\\{\\{[\\s\\S]+\\}\\}", "type": "string" } ], "description": "Exact WinGet community package identifier." }, "resolver": { "const": "winget", "description": "Built-in resolver selecting this input." }, "scope": { "anyOf": [ { "enum": [ "user", "machine" ], "type": "string" }, { "pattern": "\\{\\{[\\s\\S]+\\}\\}", "type": "string" } ], "description": "Optional declared installer scope filter. Omit only when selection is unambiguous." }, "version": { "anyOf": [ { "type": "string" }, { "pattern": "\\{\\{[\\s\\S]+\\}\\}", "type": "string" } ], "description": "Exact published version or latest (the default). Selects the release before filtering installers." } }, "propertyNames": { "not": { "pattern": "\\{\\{" } }, "type": "object" } ], "type": "object" }, "Plugin": { "additionalProperties": false, "oneOf": [ { "not": { "anyOf": [ { "required": [ "path" ] }, { "required": [ "entrypoint" ] } ] }, "required": [ "image" ] }, { "not": { "required": [ "image" ] }, "required": [ "path" ] } ], "properties": { "entrypoint": { "anyOf": [ { "type": "string" }, { "pattern": "\\{\\{[\\s\\S]+\\}\\}", "type": "string" } ], "description": "Executable within a local directory. Defaults to plugin, or plugin.exe on Windows." }, "image": { "anyOf": [ { "type": "string" }, { "pattern": "\\{\\{[\\s\\S]+\\}\\}", "type": "string" } ], "description": "OCI registry reference with a tag or digest." }, "path": { "anyOf": [ { "type": "string" }, { "pattern": "\\{\\{[\\s\\S]+\\}\\}", "type": "string" } ], "description": "Local executable or directory. Relative paths resolve from the Project." } }, "propertyNames": { "not": { "pattern": "\\{\\{" } }, "type": "object" }, "ProjectDocument": { "additionalProperties": false, "properties": { "apiVersion": { "enum": [ "stemma/v1alpha1" ], "type": "string" }, "kind": { "enum": [ "Project" ], "type": "string" }, "metadata": { "$ref": "#/$defs/Metadata" }, "spec": { "$ref": "#/$defs/ProjectSpec" } }, "required": [ "apiVersion", "kind", "metadata", "spec" ], "type": "object" }, "ProjectSpec": { "additionalProperties": false, "properties": { "components": { "additionalProperties": { "type": "object" }, "description": "Reusable software defaults. Maps merge recursively; lists and null replace inherited values.", "type": "object" }, "destinations": { "additionalProperties": { "oneOf": [ { "additionalProperties": false, "properties": { "config": { "$ref": "https://stemma.invalid/editor/intune/config", "description": "Connection settings for this destination. Credentials may reference environment variables." }, "operation": { "const": "intune", "description": "Registered destination operation." } }, "required": [ "operation", "config" ], "type": "object" }, { "additionalProperties": false, "properties": { "config": { "$ref": "https://stemma.invalid/editor/jamf/config", "description": "Connection settings for this destination. Credentials may reference environment variables." }, "operation": { "const": "jamf", "description": "Registered destination operation." } }, "required": [ "operation", "config" ], "type": "object" }, { "additionalProperties": false, "properties": { "config": { "$ref": "https://stemma.invalid/editor/munki/config", "description": "Connection settings for this destination. Credentials may reference environment variables." }, "operation": { "const": "munki", "description": "Registered destination operation." } }, "required": [ "operation", "config" ], "type": "object" } ] }, "description": "Named destination connections. Resource destination names refer to these entries.", "propertyNames": { "pattern": "^[A-Za-z0-9][A-Za-z0-9._-]{0,127}$" }, "type": "object" }, "imports": { "description": "Project-relative resource document paths or globs, such as software/**/*.yaml. Every pattern must match.", "items": { "not": { "pattern": "\\{\\{" }, "type": "string" }, "minItems": 1, "type": "array" }, "plugins": { "additionalProperties": { "$ref": "#/$defs/Plugin" }, "description": "Local executables or OCI plugin images.", "type": "object" }, "reconcile": { "$ref": "#/$defs/Reconcile", "description": "How stemma reconcile integrates the repository holding this project with its source-control host." } }, "required": [ "imports" ], "type": "object" }, "Reconcile": { "additionalProperties": false, "properties": { "source_control": { "$ref": "#/$defs/SourceControl", "description": "The host that reviews proposed lock changes and records publication of the reviewed branch." } }, "required": [ "source_control" ], "type": "object" }, "SourceControl": { "additionalProperties": false, "properties": { "config": { "anyOf": [ { "propertyNames": { "not": { "pattern": "\\{\\{" } }, "type": "object" }, { "pattern": "^\\{\\{[\\s\\S]+\\}\\}$", "type": "string" } ], "description": "Provider-specific connection configuration. Reference credential environment variables instead of embedding secrets." }, "type": { "description": "Source-control provider. github covers GitHub and GitHub Enterprise Server.", "type": "string" } }, "required": [ "type" ], "type": "object" }, "WindowsSoftware": { "additionalProperties": false, "properties": { "apiVersion": { "const": "stemma/v1alpha1" }, "kind": { "const": "WindowsSoftware" }, "metadata": { "additionalProperties": false, "properties": { "name": { "pattern": "^[A-Za-z0-9][A-Za-z0-9._-]{0,127}$", "type": "string" } }, "required": [ "name" ], "type": "object" }, "profiles": { "description": "Name the opt-in workloads the resource belongs to. Runs take it only when they select one of these profiles, name it, or select a resource consuming its outputs. It still validates and keeps its reviewed lock entries.", "items": { "pattern": "^[A-Za-z0-9][A-Za-z0-9._-]{0,127}$", "type": "string" }, "type": "array", "uniqueItems": true }, "spec": { "anyOf": [ { "$id": "https://stemma.invalid/editor/resource/stemma%2Fv1alpha1%2FWindowsSoftware/complete", "additionalProperties": false, "properties": { "content": { "anyOf": [ { "additionalProperties": false, "properties": { "files": { "anyOf": [ { "additionalProperties": { "$ref": "https://stemma.invalid/catalog.schema.json#/$defs/Input" }, "propertyNames": { "not": { "pattern": "\\{\\{" } }, "type": "object" }, { "pattern": "^\\{\\{[\\s\\S]+\\}\\}$", "type": "string" } ], "description": "Additional files keyed by their relative paths in the setup tree. Each value selects its own input." } }, "propertyNames": { "not": { "pattern": "\\{\\{" } }, "type": "object" }, { "pattern": "^\\{\\{[\\s\\S]+\\}\\}$", "type": "string" } ], "description": "Supporting files added to the setup directory beside the vendor installer." }, "destinations": { "additionalProperties": { "anyOf": [ { "$ref": "https://stemma.invalid/editor/intune/metadata" }, { "$ref": "https://stemma.invalid/editor/jamf/metadata" }, { "$ref": "https://stemma.invalid/editor/munki/metadata" } ] }, "description": "Native metadata for each named Project destination. Explicit values override derived values.", "properties": {}, "propertyNames": { "pattern": "^[A-Za-z0-9][A-Za-z0-9._-]{0,127}$" }, "type": "object" }, "icon": { "anyOf": [ { "maxLength": 128, "pattern": "^[A-Za-z0-9][A-Za-z0-9._-]*$", "type": "string" }, { "pattern": "\\{\\{[\\s\\S]+\\}\\}", "type": "string" } ], "description": "Name of the icon asset icons/\u003cname\u003e.png that destinations publish. Create it with stemma icon or commit a square PNG." }, "setup_file": { "anyOf": [ { "type": "string" }, { "pattern": "\\{\\{[\\s\\S]+\\}\\}", "type": "string" } ], "description": "Setup-relative path or glob selecting the file Intune records as the setup entry point. It may name any file, such as a wrapper script. Omit to use the installer of a single-file source, the entry point of a resource output, or the only MSI or EXE in a setup directory or archive." }, "signatures": { "anyOf": [ { "items": { "anyOf": [ { "additionalProperties": false, "oneOf": [ { "required": [ "signer" ] }, { "required": [ "unsigned" ] } ], "properties": { "signer": { "anyOf": [ { "minLength": 1, "type": "string" }, { "pattern": "\\{\\{[\\s\\S]+\\}\\}", "type": "string" } ], "description": "Expected publisher: apple:developer-id:\u003cTEAMID\u003e, apple:app-store:\u003cTEAMID\u003e or authenticode:\u003cSHA256\u003e. Mutually exclusive with unsigned." }, "subject": { "anyOf": [ { "additionalProperties": false, "minProperties": 1, "properties": { "bundle_id": { "anyOf": [ { "type": "string" }, { "pattern": "\\{\\{[\\s\\S]+\\}\\}", "type": "string" } ], "description": "Application bundle identifier, combined with any supplied path selectors." }, "installed_path": { "anyOf": [ { "type": "string" }, { "pattern": "\\{\\{[\\s\\S]+\\}\\}", "type": "string" } ], "description": "Observed absolute installation path, when the installer declares one." }, "kind": { "anyOf": [ { "type": "string" }, { "pattern": "\\{\\{[\\s\\S]+\\}\\}", "type": "string" } ], "description": "Observed subject kind, such as app, container, file, package or msi. A package subject describes a receipt; the outer PKG is a container." }, "package_id": { "anyOf": [ { "type": "string" }, { "pattern": "\\{\\{[\\s\\S]+\\}\\}", "type": "string" } ], "description": "Package identifier of a component receipt, as macOS records it." }, "path": { "anyOf": [ { "type": "string" }, { "pattern": "\\{\\{[\\s\\S]+\\}\\}", "type": "string" } ], "description": "Exact path within the inspected artifact. A dot selects the artifact root." } }, "propertyNames": { "not": { "pattern": "\\{\\{" } }, "type": "object" }, { "pattern": "^\\{\\{[\\s\\S]+\\}\\}$", "type": "string" } ], "description": "One physical signing subject. Omit it where there is only one, such as the PKG itself or the only application in an image. Component receipts do not carry the outer PKG signature." }, "unsigned": { "anyOf": [ { "enum": [ true ], "type": "boolean" }, { "pattern": "^\\{\\{[\\s\\S]+\\}\\}$", "type": "string" } ], "description": "Assert that the subject has no signature. A signed, invalid or unsupported signature fails this assertion." } }, "propertyNames": { "not": { "pattern": "\\{\\{" } }, "type": "object" }, { "pattern": "^\\{\\{[\\s\\S]+\\}\\}$", "type": "string" } ] }, "minItems": 1, "type": "array" }, { "pattern": "^\\{\\{[\\s\\S]+\\}\\}$", "type": "string" } ], "description": "Signing expectation for the selected setup entry point, the only signing subject, so its entry needs no subject. Omit to make no signing assertion." }, "source": { "$ref": "https://stemma.invalid/catalog.schema.json#/$defs/Input", "description": "Vendor installer, setup directory or ZIP or TAR archive holding a setup directory, or a resource output. A WindowsSoftware document requires a source." }, "subjects": { "anyOf": [ { "additionalProperties": { "anyOf": [ { "additionalProperties": false, "properties": { "bundle_id": { "anyOf": [ { "type": "string" }, { "pattern": "\\{\\{[\\s\\S]+\\}\\}", "type": "string" } ], "description": "Application bundle identifier, combined with any supplied path selectors." }, "installed_path": { "anyOf": [ { "type": "string" }, { "pattern": "\\{\\{[\\s\\S]+\\}\\}", "type": "string" } ], "description": "Observed absolute installation path, when the installer declares one." }, "kind": { "anyOf": [ { "type": "string" }, { "pattern": "\\{\\{[\\s\\S]+\\}\\}", "type": "string" } ], "description": "Observed subject kind, such as app, container, file, package or msi. A package subject describes a receipt; the outer PKG is a container." }, "package_id": { "anyOf": [ { "type": "string" }, { "pattern": "\\{\\{[\\s\\S]+\\}\\}", "type": "string" } ], "description": "Package identifier of a component receipt, as macOS records it." }, "path": { "anyOf": [ { "type": "string" }, { "pattern": "\\{\\{[\\s\\S]+\\}\\}", "type": "string" } ], "description": "Exact path within the inspected artifact. A dot selects the artifact root." } }, "propertyNames": { "not": { "pattern": "\\{\\{" } }, "type": "object" }, { "pattern": "^\\{\\{[\\s\\S]+\\}\\}$", "type": "string" } ] }, "propertyNames": { "not": { "pattern": "\\{\\{" } }, "type": "object" }, { "pattern": "^\\{\\{[\\s\\S]+\\}\\}$", "type": "string" } ], "description": "Named inspection subjects exposed in destination expressions as facts.\u003cname\u003e." }, "version_file": { "anyOf": [ { "type": "string" }, { "pattern": "\\{\\{[\\s\\S]+\\}\\}", "type": "string" } ], "description": "Name of the file the setup MSI installs whose File table version is the managed version, such as Zoom.exe. It must name one versioned file. Omit to use the MSI ProductVersion." } }, "propertyNames": { "not": { "pattern": "\\{\\{" } }, "required": [ "source", "destinations" ], "type": "object" }, { "allOf": [ { "$id": "https://stemma.invalid/editor/resource/stemma%2Fv1alpha1%2FWindowsSoftware/partial", "additionalProperties": false, "properties": { "content": { "anyOf": [ { "additionalProperties": false, "properties": { "files": { "anyOf": [ { "additionalProperties": { "$ref": "https://stemma.invalid/catalog.schema.json#/$defs/PartialInput" }, "propertyNames": { "not": { "pattern": "\\{\\{" } }, "type": "object" }, { "pattern": "^\\{\\{[\\s\\S]+\\}\\}$", "type": "string" } ], "description": "Additional files keyed by their relative paths in the setup tree. Each value selects its own input." } }, "propertyNames": { "not": { "pattern": "\\{\\{" } }, "type": "object" }, { "pattern": "^\\{\\{[\\s\\S]+\\}\\}$", "type": "string" } ], "description": "Supporting files added to the setup directory beside the vendor installer." }, "destinations": { "additionalProperties": { "anyOf": [ { "$ref": "https://stemma.invalid/editor/intune/metadata" }, { "$ref": "https://stemma.invalid/editor/jamf/metadata" }, { "$ref": "https://stemma.invalid/editor/munki/metadata" } ] }, "description": "Native metadata for each named Project destination. Explicit values override derived values.", "properties": {}, "propertyNames": { "pattern": "^[A-Za-z0-9][A-Za-z0-9._-]{0,127}$" }, "type": "object" }, "extends": { "pattern": "^[A-Za-z0-9][A-Za-z0-9._-]{0,127}$", "type": "string" }, "icon": { "anyOf": [ { "maxLength": 128, "pattern": "^[A-Za-z0-9][A-Za-z0-9._-]*$", "type": "string" }, { "pattern": "\\{\\{[\\s\\S]+\\}\\}", "type": "string" } ], "description": "Name of the icon asset icons/\u003cname\u003e.png that destinations publish. Create it with stemma icon or commit a square PNG." }, "setup_file": { "anyOf": [ { "type": "string" }, { "pattern": "\\{\\{[\\s\\S]+\\}\\}", "type": "string" } ], "description": "Setup-relative path or glob selecting the file Intune records as the setup entry point. It may name any file, such as a wrapper script. Omit to use the installer of a single-file source, the entry point of a resource output, or the only MSI or EXE in a setup directory or archive." }, "signatures": { "anyOf": [ { "items": { "anyOf": [ { "additionalProperties": false, "allOf": [ { "anyOf": [ {}, {} ] } ], "properties": { "signer": { "anyOf": [ { "minLength": 1, "type": "string" }, { "pattern": "\\{\\{[\\s\\S]+\\}\\}", "type": "string" } ], "description": "Expected publisher: apple:developer-id:\u003cTEAMID\u003e, apple:app-store:\u003cTEAMID\u003e or authenticode:\u003cSHA256\u003e. Mutually exclusive with unsigned." }, "subject": { "anyOf": [ { "additionalProperties": false, "minProperties": 1, "properties": { "bundle_id": { "anyOf": [ { "type": "string" }, { "pattern": "\\{\\{[\\s\\S]+\\}\\}", "type": "string" } ], "description": "Application bundle identifier, combined with any supplied path selectors." }, "installed_path": { "anyOf": [ { "type": "string" }, { "pattern": "\\{\\{[\\s\\S]+\\}\\}", "type": "string" } ], "description": "Observed absolute installation path, when the installer declares one." }, "kind": { "anyOf": [ { "type": "string" }, { "pattern": "\\{\\{[\\s\\S]+\\}\\}", "type": "string" } ], "description": "Observed subject kind, such as app, container, file, package or msi. A package subject describes a receipt; the outer PKG is a container." }, "package_id": { "anyOf": [ { "type": "string" }, { "pattern": "\\{\\{[\\s\\S]+\\}\\}", "type": "string" } ], "description": "Package identifier of a component receipt, as macOS records it." }, "path": { "anyOf": [ { "type": "string" }, { "pattern": "\\{\\{[\\s\\S]+\\}\\}", "type": "string" } ], "description": "Exact path within the inspected artifact. A dot selects the artifact root." } }, "propertyNames": { "not": { "pattern": "\\{\\{" } }, "type": "object" }, { "pattern": "^\\{\\{[\\s\\S]+\\}\\}$", "type": "string" } ], "description": "One physical signing subject. Omit it where there is only one, such as the PKG itself or the only application in an image. Component receipts do not carry the outer PKG signature." }, "unsigned": { "anyOf": [ { "enum": [ true ], "type": "boolean" }, { "pattern": "^\\{\\{[\\s\\S]+\\}\\}$", "type": "string" } ], "description": "Assert that the subject has no signature. A signed, invalid or unsupported signature fails this assertion." } }, "propertyNames": { "not": { "pattern": "\\{\\{" } }, "type": "object" }, { "pattern": "^\\{\\{[\\s\\S]+\\}\\}$", "type": "string" } ] }, "minItems": 1, "type": "array" }, { "pattern": "^\\{\\{[\\s\\S]+\\}\\}$", "type": "string" } ], "description": "Signing expectation for the selected setup entry point, the only signing subject, so its entry needs no subject. Omit to make no signing assertion." }, "source": { "$ref": "https://stemma.invalid/catalog.schema.json#/$defs/PartialInput", "description": "Vendor installer, setup directory or ZIP or TAR archive holding a setup directory, or a resource output. A WindowsSoftware document requires a source." }, "subjects": { "anyOf": [ { "additionalProperties": { "anyOf": [ { "additionalProperties": false, "properties": { "bundle_id": { "anyOf": [ { "type": "string" }, { "pattern": "\\{\\{[\\s\\S]+\\}\\}", "type": "string" } ], "description": "Application bundle identifier, combined with any supplied path selectors." }, "installed_path": { "anyOf": [ { "type": "string" }, { "pattern": "\\{\\{[\\s\\S]+\\}\\}", "type": "string" } ], "description": "Observed absolute installation path, when the installer declares one." }, "kind": { "anyOf": [ { "type": "string" }, { "pattern": "\\{\\{[\\s\\S]+\\}\\}", "type": "string" } ], "description": "Observed subject kind, such as app, container, file, package or msi. A package subject describes a receipt; the outer PKG is a container." }, "package_id": { "anyOf": [ { "type": "string" }, { "pattern": "\\{\\{[\\s\\S]+\\}\\}", "type": "string" } ], "description": "Package identifier of a component receipt, as macOS records it." }, "path": { "anyOf": [ { "type": "string" }, { "pattern": "\\{\\{[\\s\\S]+\\}\\}", "type": "string" } ], "description": "Exact path within the inspected artifact. A dot selects the artifact root." } }, "propertyNames": { "not": { "pattern": "\\{\\{" } }, "type": "object" }, { "pattern": "^\\{\\{[\\s\\S]+\\}\\}$", "type": "string" } ] }, "propertyNames": { "not": { "pattern": "\\{\\{" } }, "type": "object" }, { "pattern": "^\\{\\{[\\s\\S]+\\}\\}$", "type": "string" } ], "description": "Named inspection subjects exposed in destination expressions as facts.\u003cname\u003e." }, "version_file": { "anyOf": [ { "type": "string" }, { "pattern": "\\{\\{[\\s\\S]+\\}\\}", "type": "string" } ], "description": "Name of the file the setup MSI installs whose File table version is the managed version, such as Zoom.exe. It must name one versioned file. Omit to use the MSI ProductVersion." } }, "propertyNames": { "not": { "pattern": "\\{\\{" } }, "type": "object" }, { "required": [ "extends" ] } ] } ] }, "suspend": { "description": "Keep the resource out of every run that does not name it, whatever profiles the run selects. It still validates and keeps its reviewed lock entries; naming it, or a suspended resource consuming its outputs, runs it.", "type": "boolean" } }, "required": [ "apiVersion", "kind", "metadata", "spec" ], "type": "object" } }, "$id": "https://stemma.invalid/catalog.schema.json", "$schema": "https://json-schema.org/draft/2020-12/schema", "description": "A Project imports family files containing resource documents separated by ---. Each kind owns preparation; destination operations own native publication fields.", "oneOf": [ { "$ref": "#/$defs/ProjectDocument" }, { "$ref": "#/$defs/BuildMacPkg" }, { "$ref": "#/$defs/MacSoftware" }, { "$ref": "#/$defs/WindowsSoftware" } ], "title": "Stemma documents" }