{
  "$defs": {
    "A2AAuthConfig": {
      "additionalProperties": false,
      "description": "Bearer JWT authentication configuration for the A2A server.",
      "properties": {
        "jwt": {
          "$ref": "#/$defs/A2AJwtAuthConfig",
          "description": "JWT verification settings for inbound bearer tokens."
        },
        "type": {
          "const": "bearer",
          "title": "Type",
          "type": "string"
        }
      },
      "required": [
        "type",
        "jwt"
      ],
      "title": "A2AAuthConfig",
      "type": "object"
    },
    "A2AJwtAuthConfig": {
      "additionalProperties": false,
      "description": "JWT verification settings for inbound A2A bearer auth.",
      "properties": {
        "algorithm": {
          "default": "RS256",
          "description": "JWT signing algorithm used by the identity provider. Supported: HS256, HS512, RS256, RS512, ES256, ES512, PS256.",
          "title": "Algorithm",
          "type": "string"
        },
        "audience": {
          "anyOf": [
            {
              "type": "string"
            },
            {
              "type": "null"
            }
          ],
          "default": null,
          "description": "If set, reject tokens whose 'aud' claim does not match.",
          "title": "Audience"
        },
        "issuer": {
          "anyOf": [
            {
              "type": "string"
            },
            {
              "type": "null"
            }
          ],
          "default": null,
          "description": "If set, reject tokens whose 'iss' claim does not match.",
          "title": "Issuer"
        },
        "public_key_path": {
          "anyOf": [
            {
              "type": "string"
            },
            {
              "type": "null"
            }
          ],
          "default": null,
          "description": "Path to a PEM public key file. Required for asymmetric algorithms (RS*, ES*, PS*).",
          "title": "Public Key Path"
        },
        "secret": {
          "anyOf": [
            {
              "type": "string"
            },
            {
              "type": "null"
            }
          ],
          "default": null,
          "description": "Shared secret for symmetric algorithms (HS256, HS512). Use environment variable interpolation, e.g. '${JWT_SECRET}'.",
          "title": "Secret"
        }
      },
      "title": "A2AJwtAuthConfig",
      "type": "object"
    },
    "ChannelConfig": {
      "additionalProperties": true,
      "description": "A single channel entry from the ``channels:`` block of integrations.yml.",
      "properties": {
        "enabled": {
          "default": true,
          "title": "Enabled",
          "type": "boolean"
        }
      },
      "title": "ChannelConfig",
      "type": "object"
    },
    "EventBrokerSettings": {
      "additionalProperties": true,
      "description": "The ``event_broker:`` section of ``integrations.yml``.\n\n``type`` selects one of the builtin brokers or a dotted import path to a\ncustom :class:`~rasa.core.brokers.broker.EventBroker`; omitting it picks\nthe Pika (RabbitMQ) broker, the same default ``endpoints.yml`` applies.\nThe fields below are the keys authors set. Further broker keys still pass\nthrough via ``extra=\"allow\"``. Pika requires ``url``, ``username``, and\n``password`` (credentials in an ``amqp://`` URL are not enough). Do not set\n``host`` for Pika or SQL: both pass ``url`` as the constructor ``host``, so\na YAML ``host`` key raises at construction. Kafka and concurrent Kafka\naccept ``url`` as a string or a list of bootstrap ``url[:port]`` strings.",
      "properties": {
        "db": {
          "anyOf": [
            {
              "type": "string"
            },
            {
              "type": "null"
            }
          ],
          "default": null,
          "description": "Database name for type sql.",
          "title": "Db"
        },
        "dialect": {
          "anyOf": [
            {
              "type": "string"
            },
            {
              "type": "null"
            }
          ],
          "default": null,
          "description": "SQL dialect for type sql. Defaults to sqlite.",
          "title": "Dialect"
        },
        "password": {
          "anyOf": [
            {
              "type": "string"
            },
            {
              "type": "null"
            }
          ],
          "default": null,
          "description": "Password. Required for pika.",
          "title": "Password"
        },
        "path": {
          "anyOf": [
            {
              "type": "string"
            },
            {
              "type": "null"
            }
          ],
          "default": null,
          "description": "File path for type file.",
          "title": "Path"
        },
        "port": {
          "anyOf": [
            {
              "type": "integer"
            },
            {
              "type": "number"
            },
            {
              "type": "string"
            },
            {
              "type": "null"
            }
          ],
          "default": null,
          "description": "Port. A ${VAR} placeholder is allowed.",
          "title": "Port"
        },
        "queues": {
          "anyOf": [
            {
              "type": "string"
            },
            {
              "items": {
                "type": "string"
              },
              "type": "array"
            },
            {
              "type": "null"
            }
          ],
          "default": null,
          "description": "Pika queues to declare and publish to.",
          "title": "Queues"
        },
        "topic": {
          "anyOf": [
            {
              "type": "string"
            },
            {
              "type": "null"
            }
          ],
          "default": null,
          "description": "Kafka topic. Defaults to rasa_core_events.",
          "title": "Topic"
        },
        "type": {
          "anyOf": [
            {
              "type": "string"
            },
            {
              "type": "null"
            }
          ],
          "default": null,
          "description": "pika (the default), sql, file, kafka, concurrent_kafka, or a custom EventBroker import path.",
          "title": "Type"
        },
        "url": {
          "anyOf": [
            {
              "type": "string"
            },
            {
              "items": {
                "type": "string"
              },
              "type": "array"
            },
            {
              "type": "null"
            }
          ],
          "default": null,
          "description": "Broker address. Required for pika, kafka, and concurrent_kafka. Kafka accepts a list of url[:port] bootstrap servers. For sql this is the database host.",
          "title": "Url"
        },
        "username": {
          "anyOf": [
            {
              "type": "string"
            },
            {
              "type": "null"
            }
          ],
          "default": null,
          "description": "Username. Required for pika.",
          "title": "Username"
        }
      },
      "title": "EventBrokerSettings",
      "type": "object"
    },
    "JaegerTracingSettings": {
      "additionalProperties": false,
      "description": "Jaeger settings for the ``tracing:`` section of ``integrations.yml``.\n\n``host`` and ``port`` are optional. The Jaeger configurer applies its own\ndefaults when they are omitted (``localhost`` and ``4317``). Credentials\nrequire an explicit ``insecure`` choice so they are never sent in\nplaintext by default.",
      "properties": {
        "host": {
          "anyOf": [
            {
              "minLength": 1,
              "type": "string"
            },
            {
              "type": "null"
            }
          ],
          "default": null,
          "title": "Host"
        },
        "insecure": {
          "anyOf": [
            {
              "type": "boolean"
            },
            {
              "type": "null"
            }
          ],
          "default": null,
          "title": "Insecure"
        },
        "password": {
          "anyOf": [
            {
              "minLength": 1,
              "type": "string"
            },
            {
              "type": "null"
            }
          ],
          "default": null,
          "title": "Password"
        },
        "port": {
          "anyOf": [
            {
              "exclusiveMinimum": 0,
              "maximum": 65535,
              "type": "integer"
            },
            {
              "type": "null"
            }
          ],
          "default": null,
          "title": "Port"
        },
        "root_certificates": {
          "anyOf": [
            {
              "minLength": 1,
              "type": "string"
            },
            {
              "type": "null"
            }
          ],
          "default": null,
          "title": "Root Certificates"
        },
        "service_name": {
          "anyOf": [
            {
              "minLength": 1,
              "type": "string"
            },
            {
              "type": "null"
            }
          ],
          "default": null,
          "title": "Service Name"
        },
        "sync_export": {
          "anyOf": [
            {
              "type": "boolean"
            },
            {
              "type": "null"
            }
          ],
          "default": null,
          "title": "Sync Export"
        },
        "type": {
          "const": "jaeger",
          "title": "Type",
          "type": "string"
        },
        "username": {
          "anyOf": [
            {
              "minLength": 1,
              "type": "string"
            },
            {
              "type": "null"
            }
          ],
          "default": null,
          "title": "Username"
        }
      },
      "required": [
        "type"
      ],
      "title": "JaegerTracingSettings",
      "type": "object"
    },
    "KnowledgeStoreConfig": {
      "additionalProperties": false,
      "description": "Config for one searchable knowledge store from ``knowledge_stores:``.\n\nA store the agent can retrieve from via the built-in ``search_knowledge``\ntool. ``type`` selects the vector-store backend (reusing the existing\n:mod:`rasa.core.information_retrieval` backends); ``embeddings`` names a\nmodel group resolved from the packaged snapshot so query vectors match the\nindex built at train time. ``top_k`` bounds how many snippets a query\nreturns; ``namespace`` is an optional provider-specific collection/section\nselector.",
      "properties": {
        "embeddings": {
          "minLength": 1,
          "title": "Embeddings",
          "type": "string"
        },
        "id": {
          "minLength": 1,
          "title": "Id",
          "type": "string"
        },
        "namespace": {
          "anyOf": [
            {
              "type": "string"
            },
            {
              "type": "null"
            }
          ],
          "default": null,
          "title": "Namespace"
        },
        "top_k": {
          "default": 4,
          "exclusiveMinimum": 0,
          "title": "Top K",
          "type": "integer"
        },
        "type": {
          "enum": [
            "qdrant",
            "milvus",
            "faiss"
          ],
          "title": "Type",
          "type": "string"
        }
      },
      "required": [
        "id",
        "type",
        "embeddings"
      ],
      "title": "KnowledgeStoreConfig",
      "type": "object"
    },
    "LangfuseTracingSettings": {
      "additionalProperties": true,
      "description": "The ``tracing:`` section of ``integrations.yml`` for Langfuse.\n\nMirrors the Langfuse block historically authored under ``endpoints.yml``.\nRequired keys match :mod:`rasa.tracing.langfuse_config`; optional Langfuse\nknobs (``timeout``, ``debug``, ``environment``, \u2026) are passed through via\n``extra=\"allow\"`` so the apply path can set the corresponding env vars.",
      "properties": {
        "host": {
          "minLength": 1,
          "title": "Host",
          "type": "string"
        },
        "private_key": {
          "minLength": 1,
          "title": "Private Key",
          "type": "string"
        },
        "public_key": {
          "minLength": 1,
          "title": "Public Key",
          "type": "string"
        },
        "type": {
          "minLength": 1,
          "title": "Type",
          "type": "string"
        }
      },
      "required": [
        "type",
        "public_key",
        "private_key",
        "host"
      ],
      "title": "LangfuseTracingSettings",
      "type": "object"
    },
    "LockStoreSettings": {
      "additionalProperties": true,
      "description": "The ``lock_store:`` section of ``integrations.yml``.\n\n``type`` selects ``in_memory`` (the default when it is omitted), ``redis``,\n``concurrent_redis``, or a dotted import path to a custom\n:class:`~rasa.core.lock_store.LockStore`. Redis settings are checked with\n:class:`~rasa.core.lock_store.RedisLockStoreConfig` and never open a\nconnection. ``concurrent_redis`` uses the same keys; that store reads\n``host`` (``url`` is the deprecated alias ``RedisLockStoreConfig`` accepts\nfor ``type: redis``). The fields below are the keys authors set. Further\nkeys still pass through via ``extra=\"allow\"``.",
      "properties": {
        "db": {
          "anyOf": [
            {
              "type": "integer"
            },
            {
              "type": "number"
            },
            {
              "type": "string"
            },
            {
              "type": "null"
            }
          ],
          "default": null,
          "description": "Redis database number. Defaults to 1 for concurrent_redis and 0 for redis. A ${VAR} placeholder is allowed.",
          "title": "Db"
        },
        "deployment_mode": {
          "anyOf": [
            {
              "type": "string"
            },
            {
              "type": "null"
            }
          ],
          "default": null,
          "description": "standard, cluster, or sentinel.",
          "title": "Deployment Mode"
        },
        "endpoints": {
          "anyOf": [
            {
              "items": {
                "type": "string"
              },
              "type": "array"
            },
            {
              "type": "null"
            }
          ],
          "default": null,
          "description": "host:port list for cluster or sentinel mode.",
          "title": "Endpoints"
        },
        "host": {
          "anyOf": [
            {
              "type": "string"
            },
            {
              "type": "null"
            }
          ],
          "default": null,
          "description": "Redis host. Defaults to localhost.",
          "title": "Host"
        },
        "key_prefix": {
          "anyOf": [
            {
              "type": "string"
            },
            {
              "type": "null"
            }
          ],
          "default": null,
          "description": "Alphanumeric prefix for lock keys.",
          "title": "Key Prefix"
        },
        "password": {
          "anyOf": [
            {
              "type": "string"
            },
            {
              "type": "null"
            }
          ],
          "default": null,
          "description": "Redis password. Set together with username.",
          "title": "Password"
        },
        "port": {
          "anyOf": [
            {
              "type": "integer"
            },
            {
              "type": "number"
            },
            {
              "type": "string"
            },
            {
              "type": "null"
            }
          ],
          "default": null,
          "description": "Redis port. Defaults to 6379. A ${VAR} placeholder is allowed.",
          "title": "Port"
        },
        "sentinel_service": {
          "anyOf": [
            {
              "type": "string"
            },
            {
              "type": "null"
            }
          ],
          "default": null,
          "description": "Sentinel service name.",
          "title": "Sentinel Service"
        },
        "socket_timeout": {
          "anyOf": [
            {
              "type": "integer"
            },
            {
              "type": "number"
            },
            {
              "type": "string"
            },
            {
              "type": "null"
            }
          ],
          "default": null,
          "description": "Seconds before a Redis command times out.",
          "title": "Socket Timeout"
        },
        "type": {
          "anyOf": [
            {
              "type": "string"
            },
            {
              "type": "null"
            }
          ],
          "default": null,
          "description": "in_memory (the default), redis, concurrent_redis, or a custom LockStore import path.",
          "title": "Type"
        },
        "url": {
          "anyOf": [
            {
              "type": "string"
            },
            {
              "type": "null"
            }
          ],
          "default": null,
          "description": "Deprecated alias for host on type redis.",
          "title": "Url"
        },
        "use_ssl": {
          "anyOf": [
            {
              "type": "boolean"
            },
            {
              "type": "null"
            }
          ],
          "default": null,
          "description": "Use TLS for the Redis connection.",
          "title": "Use Ssl"
        },
        "username": {
          "anyOf": [
            {
              "type": "string"
            },
            {
              "type": "null"
            }
          ],
          "default": null,
          "description": "Redis username. Set together with password.",
          "title": "Username"
        }
      },
      "title": "LockStoreSettings",
      "type": "object"
    },
    "MCPFromSlotsEntry": {
      "description": "One mapping from a slot to an _meta key (sent during MCP tool calls).",
      "properties": {
        "param": {
          "description": "Key in _meta sent to the MCP server.",
          "title": "Param",
          "type": "string"
        },
        "slot": {
          "description": "Slot name to read from (tracker or agent input).",
          "title": "Slot",
          "type": "string"
        }
      },
      "required": [
        "slot",
        "param"
      ],
      "title": "MCPFromSlotsEntry",
      "type": "object"
    },
    "MCPMetaMapConfig": {
      "description": "Configuration for injecting metadata into MCP tool call _meta parameter.\n\nValues are sent to the MCP server in the _meta field of tools/call requests\nand are not visible to the LLM. Use for user context, auth, or API versioning.\n\n- from_slots: runtime values from tracker/agent slots (keyed by param).\n- static: fixed key-value pairs always sent in _meta (e.g. api_version, source).",
      "properties": {
        "from_slots": {
          "anyOf": [
            {
              "items": {
                "$ref": "#/$defs/MCPFromSlotsEntry"
              },
              "type": "array"
            },
            {
              "type": "null"
            }
          ],
          "default": null,
          "description": "List of {slot, param} mappings. Slot value is read fromtracker/agent input and sent as _meta[param].",
          "title": "From Slots"
        },
        "static": {
          "anyOf": [
            {
              "additionalProperties": {
                "type": "string"
              },
              "type": "object"
            },
            {
              "type": "null"
            }
          ],
          "default": null,
          "description": "Fixed key-value pairs always sent in _meta (e.g. api_version, source).",
          "title": "Static"
        }
      },
      "title": "MCPMetaMapConfig",
      "type": "object"
    },
    "MCPServerSpec": {
      "description": "One MCP tool server from ``integrations.yml``.\n\nA named record. Extra keys fold into ``additional_params``. ``type`` is\ninferred from the URL when omitted. ``tool_timeout`` is its own field.\n``pre_call_hook`` and ``meta_map.from_slots`` are rejected.",
      "properties": {
        "additional_params": {
          "additionalProperties": true,
          "description": "Auth and extra transport parameters for the MCP server.",
          "title": "Additional Params",
          "type": "object"
        },
        "meta_map": {
          "anyOf": [
            {
              "$ref": "#/$defs/MCPMetaMapConfig"
            },
            {
              "type": "null"
            }
          ],
          "default": null,
          "description": "Optional static _meta sent with MCP tool calls."
        },
        "name": {
          "description": "The name of the MCP server. Same charset as ``mcp/<name>:<tool>`` imports: letters, digits, ``_``, ``.``, and ``-``.",
          "minLength": 1,
          "pattern": "^[A-Za-z0-9][A-Za-z0-9_.-]*$",
          "title": "Name",
          "type": "string"
        },
        "tool_timeout": {
          "anyOf": [
            {
              "exclusiveMinimum": 0,
              "type": "number"
            },
            {
              "type": "null"
            }
          ],
          "default": null,
          "description": "Per-call timeout in seconds for tools on this server.",
          "title": "Tool Timeout"
        },
        "type": {
          "default": "http",
          "description": "The type of the MCP server (``http`` or ``https``).",
          "title": "Type",
          "type": "string"
        },
        "url": {
          "description": "The URL of the MCP server.",
          "title": "Url",
          "type": "string"
        }
      },
      "required": [
        "name",
        "url"
      ],
      "title": "MCPServerSpec",
      "type": "object"
    },
    "MantleA2AServerConfig": {
      "additionalProperties": false,
      "description": "Top-level ``a2a_server`` block of ``integrations.yml``.",
      "properties": {
        "a2a_message_cache_ttl_seconds": {
          "anyOf": [
            {
              "minimum": 0,
              "type": "integer"
            },
            {
              "type": "null"
            }
          ],
          "default": null,
          "description": "TTL in seconds for ``A2AMessageCache`` entries keyed by ``(context_id, message_id)``. YAML key is ``a2a_message_cache_ttl_seconds`` in both ``endpoints.yml`` and ``integrations.yml``. When omitted, defaults to the task timeout (600 seconds when that is unset). Set to ``0`` for immediate expiry (effectively disables replay).",
          "title": "A2A Message Cache Ttl Seconds"
        },
        "agent_card_path": {
          "anyOf": [
            {
              "type": "string"
            },
            {
              "type": "null"
            }
          ],
          "default": null,
          "title": "Agent Card Path"
        },
        "auth": {
          "anyOf": [
            {
              "$ref": "#/$defs/A2AAuthConfig"
            },
            {
              "type": "null"
            }
          ],
          "default": null
        },
        "description": {
          "description": "Required public description for the AgentCard. Used for auto-generated and placeholder cards. Ignored when 'agent_card_path' points to a static AgentCard JSON file.",
          "minLength": 1,
          "title": "Description",
          "type": "string"
        },
        "include_default_skills": {
          "default": false,
          "description": "When ``true``, customized default skills may be advertised on the AgentCard so the builder decides whether the orchestrator or this agent owns them. Engine-managed, disabled, and hidden skills are never advertised.",
          "title": "Include Default Skills",
          "type": "boolean"
        },
        "max_contexts": {
          "anyOf": [
            {
              "minimum": 0,
              "type": "integer"
            },
            {
              "type": "null"
            }
          ],
          "default": null,
          "description": "Memory guard: maximum distinct ``context_id`` sessions retained until a terminal task outcome. ``input_required`` keeps the session reserved. When omitted, defaults to 1000. Set to ``0`` to disable the cap.",
          "title": "Max Contexts"
        },
        "push_notification_allowed_hosts": {
          "anyOf": [
            {
              "items": {
                "type": "string"
              },
              "type": "array"
            },
            {
              "type": "null"
            }
          ],
          "default": null,
          "description": "Optional hostname allowlist for push callback URLs. When set, only http(s) URLs whose host matches an entry (exact or subdomain) are accepted. Loopback and private-network targets are always rejected, including hostnames that resolve to those addresses. The allowlist limits which hostnames may be registered but does not alone eliminate DNS rebinding for allowed domains the orchestrator controls; HTTPS callbacks reduce rebinding impact, while HTTP callbacks carry higher SSRF risk.",
          "title": "Push Notification Allowed Hosts"
        },
        "push_notifications_enabled": {
          "default": false,
          "description": "When ``true``, the AgentCard advertises push notifications and the server may POST task updates to orchestrator-supplied callback URLs. Disabled by default because callback URLs are client-controlled and can be an SSRF vector when the A2A endpoint is reachable by untrusted callers. Validation resolves DNS before each POST, but httpx resolves again at connect time (DNS rebinding TOCTOU); prefer HTTPS callbacks and restrict hosts with ``push_notification_allowed_hosts`` when enabling this feature.",
          "title": "Push Notifications Enabled",
          "type": "boolean"
        },
        "task_timeout_seconds": {
          "anyOf": [
            {
              "minimum": 0,
              "type": "integer"
            },
            {
              "type": "null"
            }
          ],
          "default": null,
          "description": "Maximum seconds each in-flight A2A ``task_id`` may run before the server auto-cancels that task (safety net; use explicit ``tasks/cancel`` as the primary path). Timers are per task and are not extended by later ``message/send`` on the same ``context_id``. When omitted, defaults to 600 seconds. Set to ``0`` to disable.",
          "title": "Task Timeout Seconds"
        },
        "url": {
          "anyOf": [
            {
              "type": "string"
            },
            {
              "type": "null"
            }
          ],
          "default": null,
          "description": "Public base URL of the Rasa server as seen by A2A orchestrators, advertised in the AgentCard (scheme, host, port, path prefix). If omitted at startup, ``rasa run`` builds a URL from --port, --interface, and ``--ssl-certificate`` / ``--ssl-keyfile`` flags.",
          "title": "Url"
        }
      },
      "required": [
        "description"
      ],
      "title": "MantleA2AServerConfig",
      "type": "object"
    },
    "ModelServerBasicAuth": {
      "additionalProperties": false,
      "description": "HTTP basic auth credentials for the remote model server.",
      "properties": {
        "password": {
          "title": "Password",
          "type": "string"
        },
        "username": {
          "minLength": 1,
          "title": "Username",
          "type": "string"
        }
      },
      "required": [
        "username",
        "password"
      ],
      "title": "ModelServerBasicAuth",
      "type": "object"
    },
    "ModelServerSettings": {
      "additionalProperties": false,
      "description": "The ``rasa_model_server:`` section of ``integrations.yml``.\n\nThis is the remote model server. ``endpoints.yml`` still calls the same\nblock ``models:``. It is not the ``models`` list inside a ``model_groups``\nentry. ``url`` is required. ``token`` is sent as the ``token_name`` query\nparameter (default ``token``), ``params`` and ``headers`` are added to every\npull, and ``basic_auth`` authenticates the pull request.\n``cafile`` is the optional CA bundle path ``EndpointConfig`` already accepts\non ``models:``. ``wait_time_between_pulls`` is seconds between refresh\npulls; ``0`` pulls once at startup and does not schedule a refresh. The\ndefault when the key is omitted is the factory's own (100 seconds).",
      "properties": {
        "basic_auth": {
          "anyOf": [
            {
              "$ref": "#/$defs/ModelServerBasicAuth"
            },
            {
              "type": "null"
            }
          ],
          "default": null
        },
        "cafile": {
          "anyOf": [
            {
              "minLength": 1,
              "type": "string"
            },
            {
              "type": "null"
            }
          ],
          "default": null,
          "title": "Cafile"
        },
        "headers": {
          "anyOf": [
            {
              "additionalProperties": true,
              "type": "object"
            },
            {
              "type": "null"
            }
          ],
          "default": null,
          "title": "Headers"
        },
        "params": {
          "anyOf": [
            {
              "additionalProperties": true,
              "type": "object"
            },
            {
              "type": "null"
            }
          ],
          "default": null,
          "title": "Params"
        },
        "token": {
          "anyOf": [
            {
              "minLength": 1,
              "type": "string"
            },
            {
              "type": "null"
            }
          ],
          "default": null,
          "title": "Token"
        },
        "token_name": {
          "anyOf": [
            {
              "minLength": 1,
              "type": "string"
            },
            {
              "type": "null"
            }
          ],
          "default": null,
          "title": "Token Name"
        },
        "url": {
          "minLength": 1,
          "title": "Url",
          "type": "string"
        },
        "wait_time_between_pulls": {
          "anyOf": [
            {
              "minimum": 0,
              "type": "integer"
            },
            {
              "type": "null"
            }
          ],
          "default": null,
          "title": "Wait Time Between Pulls"
        }
      },
      "required": [
        "url"
      ],
      "title": "ModelServerSettings",
      "type": "object"
    },
    "OtlpCollectorSettings": {
      "additionalProperties": false,
      "description": "OTLP collector settings for ``tracing:`` or ``metrics:``.\n\nField names match the endpoints block the OTLP configurers already read\n(``endpoint``, ``insecure``, ``root_certificates``, ``service_name``).",
      "properties": {
        "endpoint": {
          "minLength": 1,
          "title": "Endpoint",
          "type": "string"
        },
        "insecure": {
          "anyOf": [
            {
              "type": "boolean"
            },
            {
              "type": "null"
            }
          ],
          "default": null,
          "title": "Insecure"
        },
        "root_certificates": {
          "anyOf": [
            {
              "minLength": 1,
              "type": "string"
            },
            {
              "type": "null"
            }
          ],
          "default": null,
          "title": "Root Certificates"
        },
        "service_name": {
          "anyOf": [
            {
              "minLength": 1,
              "type": "string"
            },
            {
              "type": "null"
            }
          ],
          "default": null,
          "title": "Service Name"
        },
        "type": {
          "const": "otlp",
          "title": "Type",
          "type": "string"
        }
      },
      "required": [
        "type",
        "endpoint"
      ],
      "title": "OtlpCollectorSettings",
      "type": "object"
    },
    "RecordingAzureConfig": {
      "additionalProperties": false,
      "description": "Azure Blob Storage settings for call recordings.",
      "properties": {
        "account_name": {
          "title": "Account Name",
          "type": "string"
        },
        "container": {
          "title": "Container",
          "type": "string"
        },
        "endpoint_url": {
          "anyOf": [
            {
              "type": "string"
            },
            {
              "type": "null"
            }
          ],
          "default": null,
          "title": "Endpoint Url"
        },
        "prefix": {
          "default": "recordings/",
          "title": "Prefix",
          "type": "string"
        }
      },
      "required": [
        "container",
        "account_name"
      ],
      "title": "RecordingAzureConfig",
      "type": "object"
    },
    "RecordingConfig": {
      "additionalProperties": false,
      "description": "Configuration for call recordings.\n\nUnknown keys are rejected so a misspelled field is not dropped. ``provider``\nhas no default and is required when recordings are enabled.",
      "properties": {
        "azure": {
          "anyOf": [
            {
              "$ref": "#/$defs/RecordingAzureConfig"
            },
            {
              "type": "null"
            }
          ],
          "default": null
        },
        "enabled": {
          "default": false,
          "title": "Enabled",
          "type": "boolean"
        },
        "gcs": {
          "anyOf": [
            {
              "$ref": "#/$defs/RecordingGCSConfig"
            },
            {
              "type": "null"
            }
          ],
          "default": null
        },
        "local": {
          "anyOf": [
            {
              "$ref": "#/$defs/RecordingLocalConfig"
            },
            {
              "type": "null"
            }
          ],
          "default": null
        },
        "provider": {
          "anyOf": [
            {
              "type": "string"
            },
            {
              "type": "null"
            }
          ],
          "default": null,
          "title": "Provider"
        },
        "s3": {
          "anyOf": [
            {
              "$ref": "#/$defs/RecordingS3Config"
            },
            {
              "type": "null"
            }
          ],
          "default": null
        }
      },
      "title": "RecordingConfig",
      "type": "object"
    },
    "RecordingGCSConfig": {
      "additionalProperties": false,
      "description": "Google Cloud Storage settings for call recordings.",
      "properties": {
        "bucket": {
          "title": "Bucket",
          "type": "string"
        },
        "prefix": {
          "default": "recordings/",
          "title": "Prefix",
          "type": "string"
        }
      },
      "required": [
        "bucket"
      ],
      "title": "RecordingGCSConfig",
      "type": "object"
    },
    "RecordingLocalConfig": {
      "additionalProperties": false,
      "description": "Local filesystem settings for call recordings.",
      "properties": {
        "path": {
          "title": "Path",
          "type": "string"
        }
      },
      "required": [
        "path"
      ],
      "title": "RecordingLocalConfig",
      "type": "object"
    },
    "RecordingS3Config": {
      "additionalProperties": false,
      "description": "S3 object storage settings for call recordings.",
      "properties": {
        "bucket": {
          "title": "Bucket",
          "type": "string"
        },
        "endpoint_url": {
          "anyOf": [
            {
              "type": "string"
            },
            {
              "type": "null"
            }
          ],
          "default": null,
          "title": "Endpoint Url"
        },
        "prefix": {
          "default": "recordings/",
          "title": "Prefix",
          "type": "string"
        },
        "region": {
          "anyOf": [
            {
              "type": "string"
            },
            {
              "type": "null"
            }
          ],
          "default": null,
          "title": "Region"
        }
      },
      "required": [
        "bucket"
      ],
      "title": "RecordingS3Config",
      "type": "object"
    },
    "SecretReference": {
      "additionalProperties": false,
      "description": "A ``{source: secrets_manager.vault, secret_key: ...}`` credential.",
      "properties": {
        "secret_key": {
          "description": "Key of the secret in the manager.",
          "title": "Secret Key",
          "type": "string"
        },
        "source": {
          "description": "secrets_manager.<manager>, for example secrets_manager.vault.",
          "title": "Source",
          "type": "string"
        }
      },
      "required": [
        "source",
        "secret_key"
      ],
      "title": "SecretReference",
      "type": "object"
    },
    "SecretsManagerSettings": {
      "additionalProperties": false,
      "description": "The ``secrets_manager:`` section of ``integrations.yml``.\n\n``type`` must be ``vault``. The keys are the ones\n:func:`~rasa.core.secrets_manager.factory.read_vault_endpoint_config`\nreads: ``url``, ``token``, ``secrets_path``, ``transit_mount_point``,\n``namespace``, and ``mount_point``. Unknown keys are rejected. ``VAULT_*``\nenvironment variables are merged later, when the manager is loaded, and\nthis model does not open a Vault connection.",
      "properties": {
        "mount_point": {
          "anyOf": [
            {
              "type": "string"
            },
            {
              "type": "null"
            }
          ],
          "default": null,
          "title": "Mount Point"
        },
        "namespace": {
          "anyOf": [
            {
              "type": "string"
            },
            {
              "type": "null"
            }
          ],
          "default": null,
          "title": "Namespace"
        },
        "secrets_path": {
          "anyOf": [
            {
              "type": "string"
            },
            {
              "type": "null"
            }
          ],
          "default": null,
          "title": "Secrets Path"
        },
        "token": {
          "anyOf": [
            {
              "type": "string"
            },
            {
              "type": "null"
            }
          ],
          "default": null,
          "title": "Token"
        },
        "transit_mount_point": {
          "anyOf": [
            {
              "type": "string"
            },
            {
              "type": "null"
            }
          ],
          "default": null,
          "title": "Transit Mount Point"
        },
        "type": {
          "title": "Type",
          "type": "string"
        },
        "url": {
          "anyOf": [
            {
              "type": "string"
            },
            {
              "type": "null"
            }
          ],
          "default": null,
          "title": "Url"
        }
      },
      "required": [
        "type"
      ],
      "title": "SecretsManagerSettings",
      "type": "object"
    },
    "TimerStoreSettings": {
      "additionalProperties": true,
      "description": "The ``timer_store:`` section of ``integrations.yml``.\n\n``type`` selects ``in_memory`` (the default when it is omitted), ``redis``,\nor a dotted import path to a custom\n:class:`~rasa.core.timer_stores.timer_store.SessionTimerStore`. Redis\nsettings are checked with\n:class:`~rasa.core.timer_stores.redis_timer_store.RedisSessionTimerStoreConfig`,\nwhich reads ``host`` and ``port`` (``url`` is its deprecated alias for\n``host``). The fields below are the keys authors set. Further keys still\npass through via ``extra=\"allow\"``.",
      "properties": {
        "db": {
          "anyOf": [
            {
              "type": "integer"
            },
            {
              "type": "number"
            },
            {
              "type": "string"
            },
            {
              "type": "null"
            }
          ],
          "default": null,
          "description": "Redis database number. Defaults to 2. A ${VAR} placeholder is allowed.",
          "title": "Db"
        },
        "deployment_mode": {
          "anyOf": [
            {
              "type": "string"
            },
            {
              "type": "null"
            }
          ],
          "default": null,
          "description": "standard, cluster, or sentinel.",
          "title": "Deployment Mode"
        },
        "endpoints": {
          "anyOf": [
            {
              "items": {
                "type": "string"
              },
              "type": "array"
            },
            {
              "type": "null"
            }
          ],
          "default": null,
          "description": "host:port list for cluster or sentinel mode.",
          "title": "Endpoints"
        },
        "host": {
          "anyOf": [
            {
              "type": "string"
            },
            {
              "type": "null"
            }
          ],
          "default": null,
          "description": "Redis host. Defaults to localhost.",
          "title": "Host"
        },
        "key_prefix": {
          "anyOf": [
            {
              "type": "string"
            },
            {
              "type": "null"
            }
          ],
          "default": null,
          "description": "Alphanumeric prefix for timer keys.",
          "title": "Key Prefix"
        },
        "password": {
          "anyOf": [
            {
              "type": "string"
            },
            {
              "type": "null"
            }
          ],
          "default": null,
          "description": "Redis password.",
          "title": "Password"
        },
        "poll_interval": {
          "anyOf": [
            {
              "type": "integer"
            },
            {
              "type": "number"
            },
            {
              "type": "string"
            },
            {
              "type": "null"
            }
          ],
          "default": null,
          "description": "Seconds between checks for expired timers.",
          "title": "Poll Interval"
        },
        "port": {
          "anyOf": [
            {
              "type": "integer"
            },
            {
              "type": "number"
            },
            {
              "type": "string"
            },
            {
              "type": "null"
            }
          ],
          "default": null,
          "description": "Redis port. Defaults to 6379. A ${VAR} placeholder is allowed.",
          "title": "Port"
        },
        "sentinel_service": {
          "anyOf": [
            {
              "type": "string"
            },
            {
              "type": "null"
            }
          ],
          "default": null,
          "description": "Sentinel service name.",
          "title": "Sentinel Service"
        },
        "socket_timeout": {
          "anyOf": [
            {
              "type": "integer"
            },
            {
              "type": "number"
            },
            {
              "type": "string"
            },
            {
              "type": "null"
            }
          ],
          "default": null,
          "description": "Seconds before a Redis command times out.",
          "title": "Socket Timeout"
        },
        "ssl_ca_certs": {
          "anyOf": [
            {
              "type": "string"
            },
            {
              "type": "null"
            }
          ],
          "default": null,
          "description": "Path to the TLS CA bundle.",
          "title": "Ssl Ca Certs"
        },
        "ssl_certfile": {
          "anyOf": [
            {
              "type": "string"
            },
            {
              "type": "null"
            }
          ],
          "default": null,
          "description": "Path to the TLS certificate file.",
          "title": "Ssl Certfile"
        },
        "ssl_keyfile": {
          "anyOf": [
            {
              "type": "string"
            },
            {
              "type": "null"
            }
          ],
          "default": null,
          "description": "Path to the TLS private key file.",
          "title": "Ssl Keyfile"
        },
        "type": {
          "anyOf": [
            {
              "type": "string"
            },
            {
              "type": "null"
            }
          ],
          "default": null,
          "description": "in_memory (the default), redis, or a custom SessionTimerStore import path.",
          "title": "Type"
        },
        "url": {
          "anyOf": [
            {
              "type": "string"
            },
            {
              "type": "null"
            }
          ],
          "default": null,
          "description": "Deprecated alias for host.",
          "title": "Url"
        },
        "use_ssl": {
          "anyOf": [
            {
              "type": "boolean"
            },
            {
              "type": "null"
            }
          ],
          "default": null,
          "description": "Use TLS for the Redis connection.",
          "title": "Use Ssl"
        },
        "username": {
          "anyOf": [
            {
              "type": "string"
            },
            {
              "type": "null"
            }
          ],
          "default": null,
          "description": "Redis username.",
          "title": "Username"
        }
      },
      "title": "TimerStoreSettings",
      "type": "object"
    },
    "TrackerStoreSettings": {
      "additionalProperties": true,
      "description": "The ``tracker_store:`` section of ``integrations.yml``.\n\n``type`` selects ``in_memory`` (the default when it is omitted), ``redis``,\n``mongod``, ``sql``, ``dynamo``, or a dotted import path to a custom\n:class:`~rasa.core.tracker_stores.tracker_store.TrackerStore`. ``in_memory``\nis stored without a type so the factory takes its missing-type branch\ninstead of the custom-module fallback. The fields below are the keys\nauthors set. Further store keys still pass through via ``extra=\"allow\"``.\n``username`` and ``password`` may be strings or a secrets-manager mapping\n(``source`` plus ``secret_key``).",
      "properties": {
        "auth_source": {
          "anyOf": [
            {
              "type": "string"
            },
            {
              "type": "null"
            }
          ],
          "default": null,
          "description": "Mongo authentication database.",
          "title": "Auth Source"
        },
        "collection": {
          "anyOf": [
            {
              "type": "string"
            },
            {
              "type": "null"
            }
          ],
          "default": null,
          "description": "Mongo collection name.",
          "title": "Collection"
        },
        "db": {
          "anyOf": [
            {
              "type": "string"
            },
            {
              "type": "integer"
            },
            {
              "type": "null"
            }
          ],
          "default": null,
          "description": "Database name, or the Redis database number.",
          "title": "Db"
        },
        "dialect": {
          "anyOf": [
            {
              "type": "string"
            },
            {
              "type": "null"
            }
          ],
          "default": null,
          "description": "SQL dialect. Defaults to sqlite.",
          "title": "Dialect"
        },
        "host": {
          "anyOf": [
            {
              "type": "string"
            },
            {
              "type": "null"
            }
          ],
          "default": null,
          "description": "Redis host. Defaults to localhost.",
          "title": "Host"
        },
        "key_prefix": {
          "anyOf": [
            {
              "type": "string"
            },
            {
              "type": "null"
            }
          ],
          "default": null,
          "description": "Prefix for Redis tracker keys.",
          "title": "Key Prefix"
        },
        "login_db": {
          "anyOf": [
            {
              "type": "string"
            },
            {
              "type": "null"
            }
          ],
          "default": null,
          "description": "Database to connect to before creating db.",
          "title": "Login Db"
        },
        "password": {
          "anyOf": [
            {
              "type": "string"
            },
            {
              "$ref": "#/$defs/SecretReference"
            },
            {
              "type": "null"
            }
          ],
          "default": null,
          "description": "Database password, or a secrets_manager source and secret_key.",
          "title": "Password"
        },
        "port": {
          "anyOf": [
            {
              "type": "integer"
            },
            {
              "type": "number"
            },
            {
              "type": "string"
            },
            {
              "type": "null"
            }
          ],
          "default": null,
          "description": "Port. A ${VAR} placeholder is allowed.",
          "title": "Port"
        },
        "region": {
          "anyOf": [
            {
              "type": "string"
            },
            {
              "type": "null"
            }
          ],
          "default": null,
          "description": "DynamoDB region.",
          "title": "Region"
        },
        "table_name": {
          "anyOf": [
            {
              "type": "string"
            },
            {
              "type": "null"
            }
          ],
          "default": null,
          "description": "DynamoDB table name.",
          "title": "Table Name"
        },
        "type": {
          "anyOf": [
            {
              "type": "string"
            },
            {
              "type": "null"
            }
          ],
          "default": null,
          "description": "in_memory (the default), redis, mongod, sql, dynamo, or a custom TrackerStore import path.",
          "title": "Type"
        },
        "url": {
          "anyOf": [
            {
              "type": "string"
            },
            {
              "type": "null"
            }
          ],
          "default": null,
          "description": "Store address. For sql and mongod this is the host.",
          "title": "Url"
        },
        "username": {
          "anyOf": [
            {
              "type": "string"
            },
            {
              "$ref": "#/$defs/SecretReference"
            },
            {
              "type": "null"
            }
          ],
          "default": null,
          "description": "Database user, or a secrets_manager source and secret_key.",
          "title": "Username"
        }
      },
      "title": "TrackerStoreSettings",
      "type": "object"
    }
  },
  "additionalProperties": false,
  "description": "Authoring shape of ``integrations.yml``.\n\n``model_groups`` stays a list of mappings; the orchestrator names its group\nin ``agent.yml``, so there is no ``llm:`` key. Channel entries allow\nchannel-specific keys. ``tracing`` is one tracer or a list of tracers.\n``metrics`` is an OTLP collector. ``a2a_server`` is the top-level inbound\nA2A block, not a channel. ``event_broker``, ``timer_store``,\n``tracker_store``, ``lock_store``, ``secrets_manager``,\n``rasa_model_server``, and ``recordings`` use the same models startup\nvalidates.",
  "properties": {
    "a2a_server": {
      "anyOf": [
        {
          "$ref": "#/$defs/MantleA2AServerConfig"
        },
        {
          "type": "null"
        }
      ],
      "default": null
    },
    "channels": {
      "additionalProperties": {
        "anyOf": [
          {
            "$ref": "#/$defs/ChannelConfig"
          },
          {
            "type": "null"
          }
        ]
      },
      "title": "Channels",
      "type": "object"
    },
    "event_broker": {
      "anyOf": [
        {
          "$ref": "#/$defs/EventBrokerSettings"
        },
        {
          "type": "null"
        }
      ],
      "default": null
    },
    "knowledge_stores": {
      "items": {
        "$ref": "#/$defs/KnowledgeStoreConfig"
      },
      "title": "Knowledge Stores",
      "type": "array"
    },
    "lock_store": {
      "anyOf": [
        {
          "$ref": "#/$defs/LockStoreSettings"
        },
        {
          "type": "null"
        }
      ],
      "default": null
    },
    "mcp_servers": {
      "items": {
        "$ref": "#/$defs/MCPServerSpec"
      },
      "title": "Mcp Servers",
      "type": "array"
    },
    "metrics": {
      "anyOf": [
        {
          "$ref": "#/$defs/OtlpCollectorSettings"
        },
        {
          "type": "null"
        }
      ],
      "default": null
    },
    "model_groups": {
      "items": {
        "additionalProperties": true,
        "type": "object"
      },
      "title": "Model Groups",
      "type": "array"
    },
    "rasa_model_server": {
      "anyOf": [
        {
          "$ref": "#/$defs/ModelServerSettings"
        },
        {
          "type": "null"
        }
      ],
      "default": null
    },
    "recordings": {
      "anyOf": [
        {
          "$ref": "#/$defs/RecordingConfig"
        },
        {
          "type": "null"
        }
      ],
      "default": null
    },
    "secrets_manager": {
      "anyOf": [
        {
          "$ref": "#/$defs/SecretsManagerSettings"
        },
        {
          "type": "null"
        }
      ],
      "default": null
    },
    "timer_store": {
      "anyOf": [
        {
          "$ref": "#/$defs/TimerStoreSettings"
        },
        {
          "type": "null"
        }
      ],
      "default": null
    },
    "tracing": {
      "anyOf": [
        {
          "$ref": "#/$defs/LangfuseTracingSettings"
        },
        {
          "$ref": "#/$defs/OtlpCollectorSettings"
        },
        {
          "$ref": "#/$defs/JaegerTracingSettings"
        },
        {
          "items": {
            "anyOf": [
              {
                "$ref": "#/$defs/LangfuseTracingSettings"
              },
              {
                "$ref": "#/$defs/OtlpCollectorSettings"
              },
              {
                "$ref": "#/$defs/JaegerTracingSettings"
              }
            ]
          },
          "type": "array"
        },
        {
          "type": "null"
        }
      ],
      "default": null,
      "title": "Tracing"
    },
    "tracker_store": {
      "anyOf": [
        {
          "$ref": "#/$defs/TrackerStoreSettings"
        },
        {
          "type": "null"
        }
      ],
      "default": null
    }
  },
  "title": "integrations.yml",
  "type": "object"
}