@techdocs/cli 1.8.18 → 1.8.19-next.1

package/dist/embedded-app/.config-schema.json

@@ -1318,8 +1318,7 @@
                         "const": "memory"
                       },
                       "defaultTtl": {
-                        "description": "An optional default TTL (in milliseconds).",
-                        "type": "number"
+                        "description": "An optional default TTL (in milliseconds)."
                       }
                     },
                     "required": [
@@ -1339,8 +1338,7 @@
                         "type": "string"
                       },
                       "defaultTtl": {
-                        "description": "An optional default TTL (in milliseconds).",
-                        "type": "number"
+                        "description": "An optional default TTL (in milliseconds)."
                       },
                       "useRedisSets": {
                         "description": "Whether or not [useRedisSets](https://github.com/jaredwray/keyv/tree/main/packages/redis#useredissets) should be configured to this redis cache.\nDefaults to true if unspecified.",
@@ -1365,8 +1363,7 @@
                         "type": "string"
                       },
                       "defaultTtl": {
-                        "description": "An optional default TTL (in milliseconds).",
-                        "type": "number"
+                        "description": "An optional default TTL (in milliseconds)."
                       }
                     },
                     "required": [
@@ -1377,6 +1374,7 @@
                 ]
               },
               "cors": {
+                "description": "Properties returned upon CORS requests to the backend, including the app-backend.",
                 "type": "object",
                 "properties": {
                   "origin": {
@@ -1445,6 +1443,24 @@
                   }
                 }
               },
+              "csp": {
+                "description": "Content Security Policy options.\n\nThe keys are the plain policy ID, e.g. \"upgrade-insecure-requests\". The\nvalues are on the format that the helmet library expects them, as an\narray of strings. There is also the special value false, which means to\nremove the default value that Backstage puts in place for that policy.",
+                "type": "object",
+                "additionalProperties": {
+                  "anyOf": [
+                    {
+                      "type": "array",
+                      "items": {
+                        "type": "string"
+                      }
+                    },
+                    {
+                      "const": false,
+                      "type": "boolean"
+                    }
+                  ]
+                }
+              },
               "reading": {
                 "description": "Configuration related to URL reading, used for example for reading catalog info\nfiles, scaffolder templates, and techdocs content.",
                 "type": "object",
@@ -1473,24 +1489,6 @@
                     }
                   }
                 }
-              },
-              "csp": {
-                "description": "Content Security Policy options.\n\nThe keys are the plain policy ID, e.g. \"upgrade-insecure-requests\". The\nvalues are on the format that the helmet library expects them, as an\narray of strings. There is also the special value false, which means to\nremove the default value that Backstage puts in place for that policy.",
-                "type": "object",
-                "additionalProperties": {
-                  "anyOf": [
-                    {
-                      "type": "array",
-                      "items": {
-                        "type": "string"
-                      }
-                    },
-                    {
-                      "const": false,
-                      "type": "boolean"
-                    }
-                  ]
-                }
               }
             },
             "required": [
@@ -1507,6 +1505,69 @@
         "$schema": "http://json-schema.org/draft-07/schema#"
       }
     },
+    {
+      "path": "../backend-plugin-api/config.d.ts",
+      "value": {
+        "type": "object",
+        "properties": {
+          "backend": {
+            "type": "object",
+            "properties": {
+              "workingDirectory": {
+                "description": "An absolute path to a directory that can be used as a working dir, for\nexample as scratch space for large operations.",
+                "type": "string"
+              }
+            }
+          }
+        },
+        "$schema": "http://json-schema.org/draft-07/schema#"
+      }
+    },
+    {
+      "path": "../../node_modules/@backstage-community/plugin-puppetdb/node_modules/@backstage/core-components/config.d.ts",
+      "value": {
+        "type": "object",
+        "properties": {
+          "auth": {
+            "type": "object",
+            "properties": {
+              "autologout": {
+                "description": "Autologout feature configuration",
+                "type": "object",
+                "properties": {
+                  "enabled": {
+                    "description": "Enable or disable the autologout feature",
+                    "visibility": "frontend",
+                    "type": "boolean"
+                  },
+                  "idleTimeoutMinutes": {
+                    "description": "Number of minutes after which the inactive user is logged out automatically.\nDefault is 60 minutes (1 hour)",
+                    "visibility": "frontend",
+                    "type": "number"
+                  },
+                  "promptBeforeIdleSeconds": {
+                    "description": "Number of seconds before the idle timeout where the user will be asked if it's still active.\nA dialog will be shown.\nDefault is 10 seconds.\nSet to 0 seconds to disable the prompt.",
+                    "visibility": "frontend",
+                    "type": "number"
+                  },
+                  "useWorkerTimers": {
+                    "description": "Enable/disable the usage of worker thread timers instead of main thread timers.\nDefault is true.\nIf you experience some browser incompatibility, you may try to set this to false.",
+                    "visibility": "frontend",
+                    "type": "boolean"
+                  },
+                  "logoutIfDisconnected": {
+                    "description": "Enable/disable the automatic logout also on users that are logged in but with no Backstage tabs open.\nDefault is true.",
+                    "visibility": "frontend",
+                    "type": "boolean"
+                  }
+                }
+              }
+            }
+          }
+        },
+        "$schema": "http://json-schema.org/draft-07/schema#"
+      }
+    },
     {
       "path": "../../node_modules/@oriflame/backstage-plugin-score-card/node_modules/@backstage/core-components/config.d.ts",
       "value": {
@@ -1669,7 +1730,120 @@
           "backend": {
             "type": "object",
             "properties": {
+              "packages": {
+                "description": "Used by the feature discovery service",
+                "anyOf": [
+                  {
+                    "type": "object",
+                    "properties": {
+                      "include": {
+                        "type": "array",
+                        "items": {
+                          "type": "string"
+                        }
+                      },
+                      "exclude": {
+                        "type": "array",
+                        "items": {
+                          "type": "string"
+                        }
+                      }
+                    }
+                  },
+                  {
+                    "const": "all",
+                    "type": "string"
+                  }
+                ]
+              }
+            }
+          }
+        },
+        "$schema": "http://json-schema.org/draft-07/schema#"
+      }
+    },
+    {
+      "path": "../backend-defaults/config.d.ts",
+      "value": {
+        "type": "object",
+        "properties": {
+          "app": {
+            "type": "object",
+            "properties": {
+              "baseUrl": {
+                "type": "string"
+              }
+            },
+            "required": [
+              "baseUrl"
+            ]
+          },
+          "backend": {
+            "type": "object",
+            "properties": {
+              "baseUrl": {
+                "description": "The full base URL of the backend, as seen from the browser's point of\nview as it makes calls to the backend.",
+                "type": "string"
+              },
+              "listen": {
+                "description": "Address that the backend should listen to.",
+                "anyOf": [
+                  {
+                    "type": "object",
+                    "properties": {
+                      "host": {
+                        "description": "Address of the interface that the backend should bind to.",
+                        "type": "string"
+                      },
+                      "port": {
+                        "description": "Port that the backend should listen to.",
+                        "type": [
+                          "string",
+                          "number"
+                        ]
+                      }
+                    }
+                  },
+                  {
+                    "type": "string"
+                  }
+                ]
+              },
+              "https": {
+                "description": "HTTPS configuration for the backend. If omitted the backend will serve HTTP.\n\nSetting this to `true` will cause self-signed certificates to be generated, which\ncan be useful for local development or other non-production scenarios.",
+                "anyOf": [
+                  {
+                    "type": "object",
+                    "properties": {
+                      "certificate": {
+                        "description": "Certificate configuration",
+                        "type": "object",
+                        "properties": {
+                          "cert": {
+                            "description": "PEM encoded certificate. Use $file to load in a file",
+                            "type": "string"
+                          },
+                          "key": {
+                            "description": "PEM encoded certificate key. Use $file to load in a file.",
+                            "visibility": "secret",
+                            "type": "string"
+                          }
+                        },
+                        "required": [
+                          "cert",
+                          "key"
+                        ]
+                      }
+                    }
+                  },
+                  {
+                    "const": true,
+                    "type": "boolean"
+                  }
+                ]
+              },
               "auth": {
+                "description": "Options used by the default auth, httpAuth and userInfo services.",
                 "type": "object",
                 "properties": {
                   "dangerouslyDisableDefaultAuthPolicy": {
@@ -1977,296 +2151,6 @@
                               "required": [
                                 "url"
                               ]
-                            }
-                          },
-                          "required": [
-                            "options",
-                            "type"
-                          ]
-                        }
-                      ]
-                    }
-                  }
-                }
-              },
-              "packages": {
-                "anyOf": [
-                  {
-                    "type": "object",
-                    "properties": {
-                      "include": {
-                        "type": "array",
-                        "items": {
-                          "type": "string"
-                        }
-                      },
-                      "exclude": {
-                        "type": "array",
-                        "items": {
-                          "type": "string"
-                        }
-                      }
-                    }
-                  },
-                  {
-                    "const": "all",
-                    "type": "string"
-                  }
-                ]
-              }
-            }
-          },
-          "discovery": {
-            "description": "Discovery options.",
-            "type": "object",
-            "properties": {
-              "endpoints": {
-                "description": "Endpoints\n\nA list of target baseUrls and the associated plugins.",
-                "type": "array",
-                "items": {
-                  "type": "object",
-                  "properties": {
-                    "target": {
-                      "description": "The target baseUrl to use for the plugin\n\nCan be either a string or an object with internal and external keys.\nTargets with `{{pluginId}}` or `{{ pluginId }} in the url will be replaced with the pluginId.",
-                      "anyOf": [
-                        {
-                          "type": "object",
-                          "properties": {
-                            "internal": {
-                              "type": "string"
-                            },
-                            "external": {
-                              "type": "string"
-                            }
-                          },
-                          "required": [
-                            "external",
-                            "internal"
-                          ]
-                        },
-                        {
-                          "type": "string"
-                        }
-                      ]
-                    },
-                    "plugins": {
-                      "description": "Array of plugins which use the target baseUrl.",
-                      "type": "array",
-                      "items": {
-                        "type": "string"
-                      }
-                    }
-                  },
-                  "required": [
-                    "plugins",
-                    "target"
-                  ]
-                }
-              }
-            },
-            "required": [
-              "endpoints"
-            ]
-          }
-        },
-        "$schema": "http://json-schema.org/draft-07/schema#"
-      }
-    },
-    {
-      "path": "../backend-defaults/config.d.ts",
-      "value": {
-        "type": "object",
-        "properties": {
-          "backend": {
-            "type": "object",
-            "properties": {
-              "auth": {
-                "description": "Options used by the default auth, httpAuth and userInfo services.",
-                "type": "object",
-                "properties": {
-                  "dangerouslyDisableDefaultAuthPolicy": {
-                    "description": "This disables the otherwise default auth policy, which requires all\nrequests to be authenticated with either user or service credentials.\n\nDisabling this check means that the backend will no longer block\nunauthenticated requests, but instead allow them to pass through to\nplugins.\n\nIf permissions are enabled, unauthenticated requests will be treated\nexactly as such, leaving it to the permission policy to determine what\npermissions should be allowed for an unauthenticated identity. Note\nthat this will also apply to service-to-service calls between plugins\nunless you configure credentials for service calls.",
-                    "type": "boolean"
-                  },
-                  "pluginKeyStore": {
-                    "description": "Controls how to store keys for plugin-to-plugin auth",
-                    "anyOf": [
-                      {
-                        "type": "object",
-                        "properties": {
-                          "type": {
-                            "type": "string",
-                            "const": "database"
-                          }
-                        },
-                        "required": [
-                          "type"
-                        ]
-                      },
-                      {
-                        "type": "object",
-                        "properties": {
-                          "type": {
-                            "type": "string",
-                            "const": "static"
-                          },
-                          "static": {
-                            "type": "object",
-                            "properties": {
-                              "keys": {
-                                "description": "Must be declared at least once and the first one will be used for signing.",
-                                "type": "array",
-                                "items": {
-                                  "type": "object",
-                                  "properties": {
-                                    "publicKeyFile": {
-                                      "description": "Path to the public key file in the SPKI format. Should be an absolute path.",
-                                      "type": "string"
-                                    },
-                                    "privateKeyFile": {
-                                      "description": "Path to the matching private key file in the PKCS#8 format. Should be an absolute path.\n\nThe first array entry must specify a private key file, the rest must not.",
-                                      "type": "string"
-                                    },
-                                    "keyId": {
-                                      "description": "ID to uniquely identify this key within the JWK set.",
-                                      "type": "string"
-                                    },
-                                    "algorithm": {
-                                      "description": "JWS \"alg\" (Algorithm) Header Parameter value. Defaults to ES256.\nMust match the algorithm used to generate the keys in the provided files",
-                                      "type": "string"
-                                    }
-                                  },
-                                  "required": [
-                                    "keyId",
-                                    "publicKeyFile"
-                                  ]
-                                }
-                              }
-                            },
-                            "required": [
-                              "keys"
-                            ]
-                          }
-                        },
-                        "required": [
-                          "static",
-                          "type"
-                        ]
-                      }
-                    ]
-                  },
-                  "externalAccess": {
-                    "description": "Configures methods of external access, ie ways for callers outside of\nthe Backstage ecosystem to get authorized for access to APIs that do\nnot permit unauthorized access.",
-                    "type": "array",
-                    "items": {
-                      "anyOf": [
-                        {
-                          "type": "object",
-                          "properties": {
-                            "type": {
-                              "description": "This is the legacy service-to-service access method, where a set\nof static keys were shared among plugins and used for symmetric\nsigning and verification. These correspond to the old\n`backend.auth.keys` set and retain their behavior for backwards\ncompatibility. Please migrate to other access methods when\npossible.\n\nCallers generate JWT tokens with the following payload:\n\n```json\n{\n  \"sub\": \"backstage-plugin\",\n  \"exp\": <epoch seconds one hour in the future>\n}\n```\n\nAnd sign them with HS256, using the base64 decoded secret. The\ntokens are then passed along with requests in the Authorization\nheader:\n\n```\nAuthorization: Bearer eyJhbGciOiJIUzI...\n```",
-                              "type": "string",
-                              "const": "legacy"
-                            },
-                            "options": {
-                              "type": "object",
-                              "properties": {
-                                "secret": {
-                                  "description": "Any set of base64 encoded random bytes to be used as both the\nsigning and verification key. Should be sufficiently long so as\nnot to be easy to guess by brute force.\n\nCan be generated eg using\n\n```sh\nnode -p 'require(\"crypto\").randomBytes(24).toString(\"base64\")'\n```",
-                                  "visibility": "secret",
-                                  "type": "string"
-                                },
-                                "subject": {
-                                  "description": "Sets the subject of the principal, when matching this token.\nUseful for debugging and tracking purposes.",
-                                  "type": "string"
-                                }
-                              },
-                              "required": [
-                                "secret",
-                                "subject"
-                              ]
-                            },
-                            "accessRestrictions": {
-                              "description": "Restricts what types of access that are permitted for this access\nmethod. If no access restrictions are given, it'll have unlimited\naccess. This access restriction applies for the framework level;\nindividual plugins may have their own access control mechanisms\non top of this.",
-                              "type": "array",
-                              "items": {
-                                "type": "object",
-                                "properties": {
-                                  "plugin": {
-                                    "description": "Permit access to make requests to this plugin.\n\nCan be further refined by setting additional fields below.",
-                                    "type": "string"
-                                  },
-                                  "permission": {
-                                    "description": "If given, this method is limited to only performing actions\nwith these named permissions in this plugin.\n\nNote that this only applies where permissions checks are\nenabled in the first place. Endpoints that are not protected by\nthe permissions system at all, are not affected by this\nsetting.",
-                                    "anyOf": [
-                                      {
-                                        "type": "array",
-                                        "items": {
-                                          "type": "string"
-                                        }
-                                      },
-                                      {
-                                        "type": "string"
-                                      }
-                                    ]
-                                  },
-                                  "permissionAttribute": {
-                                    "description": "If given, this method is limited to only performing actions\nwhose permissions have these attributes.\n\nNote that this only applies where permissions checks are\nenabled in the first place. Endpoints that are not protected by\nthe permissions system at all, are not affected by this\nsetting.",
-                                    "type": "object",
-                                    "properties": {
-                                      "action": {
-                                        "description": "One of more of 'create', 'read', 'update', or 'delete'.",
-                                        "anyOf": [
-                                          {
-                                            "type": "array",
-                                            "items": {
-                                              "type": "string"
-                                            }
-                                          },
-                                          {
-                                            "type": "string"
-                                          }
-                                        ]
-                                      }
-                                    }
-                                  }
-                                },
-                                "required": [
-                                  "plugin"
-                                ]
-                              }
-                            }
-                          },
-                          "required": [
-                            "options",
-                            "type"
-                          ]
-                        },
-                        {
-                          "type": "object",
-                          "properties": {
-                            "type": {
-                              "description": "This access method consists of random static tokens that can be\nhanded out to callers.\n\nThe tokens are then passed along verbatim with requests in the\nAuthorization header:\n\n```\nAuthorization: Bearer eZv5o+fW3KnR3kVabMW4ZcDNLPl8nmMW\n```",
-                              "type": "string",
-                              "const": "static"
-                            },
-                            "options": {
-                              "type": "object",
-                              "properties": {
-                                "token": {
-                                  "description": "A raw token that can be any string, but for security reasons\nshould be sufficiently long so as not to be easy to guess by\nbrute force.\n\nCan be generated eg using\n\n```sh\nnode -p 'require(\"crypto\").randomBytes(24).toString(\"base64\")'\n```\n\nSince the tokens can be any string, you are free to add\nadditional identifying data to them if you like. For example,\nadding a `freben-local-dev-` prefix for debugging purposes to a\ntoken that you know will be handed out for use as a personal\naccess token during development.",
-                                  "visibility": "secret",
-                                  "type": "string"
-                                },
-                                "subject": {
-                                  "description": "Sets the subject of the principal, when matching this token.\nUseful for debugging and tracking purposes.",
-                                  "type": "string"
-                                }
-                              },
-                              "required": [
-                                "subject",
-                                "token"
-                              ]
                             },
                             "accessRestrictions": {
                               "description": "Restricts what types of access that are permitted for this access\nmethod. If no access restrictions are given, it'll have unlimited\naccess. This access restriction applies for the framework level;\nindividual plugins may have their own access control mechanisms\non top of this.",
@@ -2323,135 +2207,327 @@
                             "options",
                             "type"
                           ]
-                        },
-                        {
-                          "type": "object",
-                          "properties": {
-                            "type": {
-                              "description": "This access method consists of a JWKS endpoint that can be used to\nverify JWT tokens.\n\nCallers generate JWT tokens via 3rd party tooling\nand pass them in the Authorization header:\n\n```\nAuthorization: Bearer eZv5o+fW3KnR3kVabMW4ZcDNLPl8nmMW\n```",
-                              "type": "string",
-                              "const": "jwks"
-                            },
-                            "options": {
-                              "type": "object",
-                              "properties": {
-                                "url": {
-                                  "description": "The full URL of the JWKS endpoint.",
-                                  "type": "string"
-                                },
-                                "algorithm": {
-                                  "description": "Sets the algorithm(s) that should be used to verify the JWT tokens.\nThe passed JWTs must have been signed using one of the listed algorithms.",
-                                  "anyOf": [
-                                    {
-                                      "type": "array",
-                                      "items": {
-                                        "type": "string"
-                                      }
-                                    },
-                                    {
-                                      "type": "string"
-                                    }
-                                  ]
-                                },
-                                "issuer": {
-                                  "description": "Sets the issuer(s) that should be used to verify the JWT tokens.\nPassed JWTs must have an `iss` claim which matches one of the specified issuers.",
-                                  "anyOf": [
-                                    {
-                                      "type": "array",
-                                      "items": {
-                                        "type": "string"
-                                      }
-                                    },
-                                    {
-                                      "type": "string"
-                                    }
-                                  ]
-                                },
-                                "audience": {
-                                  "description": "Sets the audience(s) that should be used to verify the JWT tokens.\nThe passed JWTs must have an \"aud\" claim that matches one of the audiences specified,\nor have no audience specified.",
-                                  "anyOf": [
-                                    {
-                                      "type": "array",
-                                      "items": {
-                                        "type": "string"
-                                      }
-                                    },
-                                    {
-                                      "type": "string"
-                                    }
-                                  ]
-                                },
-                                "subjectPrefix": {
-                                  "description": "Sets an optional subject prefix. Passes the subject to called plugins.\nUseful for debugging and tracking purposes.",
-                                  "type": "string"
-                                }
-                              },
-                              "required": [
-                                "url"
-                              ]
-                            },
-                            "accessRestrictions": {
-                              "description": "Restricts what types of access that are permitted for this access\nmethod. If no access restrictions are given, it'll have unlimited\naccess. This access restriction applies for the framework level;\nindividual plugins may have their own access control mechanisms\non top of this.",
-                              "type": "array",
-                              "items": {
-                                "type": "object",
-                                "properties": {
-                                  "plugin": {
-                                    "description": "Permit access to make requests to this plugin.\n\nCan be further refined by setting additional fields below.",
-                                    "type": "string"
-                                  },
-                                  "permission": {
-                                    "description": "If given, this method is limited to only performing actions\nwith these named permissions in this plugin.\n\nNote that this only applies where permissions checks are\nenabled in the first place. Endpoints that are not protected by\nthe permissions system at all, are not affected by this\nsetting.",
-                                    "anyOf": [
-                                      {
-                                        "type": "array",
-                                        "items": {
-                                          "type": "string"
-                                        }
-                                      },
-                                      {
-                                        "type": "string"
-                                      }
-                                    ]
-                                  },
-                                  "permissionAttribute": {
-                                    "description": "If given, this method is limited to only performing actions\nwhose permissions have these attributes.\n\nNote that this only applies where permissions checks are\nenabled in the first place. Endpoints that are not protected by\nthe permissions system at all, are not affected by this\nsetting.",
-                                    "type": "object",
-                                    "properties": {
-                                      "action": {
-                                        "description": "One of more of 'create', 'read', 'update', or 'delete'.",
-                                        "anyOf": [
-                                          {
-                                            "type": "array",
-                                            "items": {
-                                              "type": "string"
-                                            }
-                                          },
-                                          {
-                                            "type": "string"
-                                          }
-                                        ]
-                                      }
-                                    }
-                                  }
-                                },
-                                "required": [
-                                  "plugin"
-                                ]
-                              }
+                        }
+                      ]
+                    }
+                  }
+                }
+              },
+              "database": {
+                "description": "Database connection configuration, select base database type using the `client` field",
+                "type": "object",
+                "properties": {
+                  "client": {
+                    "description": "Default database client to use",
+                    "enum": [
+                      "better-sqlite3",
+                      "pg",
+                      "sqlite3"
+                    ],
+                    "type": "string"
+                  },
+                  "connection": {
+                    "description": "Base database connection string, or object with individual connection properties",
+                    "visibility": "secret",
+                    "anyOf": [
+                      {
+                        "type": "object",
+                        "additionalProperties": {},
+                        "properties": {
+                          "password": {
+                            "description": "Password that belongs to the client User",
+                            "visibility": "secret",
+                            "type": "string"
+                          }
+                        }
+                      },
+                      {
+                        "type": "string"
+                      }
+                    ]
+                  },
+                  "prefix": {
+                    "description": "Database name prefix override",
+                    "type": "string"
+                  },
+                  "ensureExists": {
+                    "description": "Whether to ensure the given database exists by creating it if it does not.\nDefaults to true if unspecified.",
+                    "type": "boolean"
+                  },
+                  "ensureSchemaExists": {
+                    "description": "Whether to ensure the given database schema exists by creating it if it does not.\nDefaults to false if unspecified.\n\nNOTE: Currently only supported by the `pg` client when pluginDivisionMode: schema",
+                    "type": "boolean"
+                  },
+                  "pluginDivisionMode": {
+                    "description": "How plugins databases are managed/divided in the provided database instance.\n\n`database` -> Plugins are each given their own database to manage their schemas/tables.\n\n`schema` -> Plugins will be given their own schema (in the specified/default database)\n            to manage their tables.\n\nNOTE: Currently only supported by the `pg` client.",
+                    "default": "database",
+                    "enum": [
+                      "database",
+                      "schema"
+                    ],
+                    "type": "string"
+                  },
+                  "role": {
+                    "description": "Configures the ownership of newly created schemas in pg databases.",
+                    "type": "string"
+                  },
+                  "knexConfig": {
+                    "description": "Arbitrary config object to pass to knex when initializing\n(https://knexjs.org/#Installation-client). Most notable is the debug\nand asyncStackTraces booleans",
+                    "type": "object",
+                    "properties": {},
+                    "additionalProperties": true
+                  },
+                  "skipMigrations": {
+                    "description": "Skip running database migrations.",
+                    "type": "boolean"
+                  },
+                  "plugin": {
+                    "description": "Plugin specific database configuration and client override",
+                    "type": "object",
+                    "additionalProperties": {
+                      "type": "object",
+                      "properties": {
+                        "client": {
+                          "description": "Database client override",
+                          "enum": [
+                            "better-sqlite3",
+                            "pg",
+                            "sqlite3"
+                          ],
+                          "type": "string"
+                        },
+                        "connection": {
+                          "description": "Database connection string or Knex object override",
+                          "visibility": "secret",
+                          "anyOf": [
+                            {
+                              "type": "object",
+                              "properties": {},
+                              "additionalProperties": true
+                            },
+                            {
+                              "type": "string"
                             }
-                          },
-                          "required": [
-                            "options",
-                            "type"
                           ]
+                        },
+                        "ensureExists": {
+                          "description": "Whether to ensure the given database exists by creating it if it does not.\nDefaults to base config if unspecified.",
+                          "type": "boolean"
+                        },
+                        "ensureSchemaExists": {
+                          "description": "Whether to ensure the given database schema exists by creating it if it does not.\nDefaults to false if unspecified.\n\nNOTE: Currently only supported by the `pg` client when pluginDivisionMode: schema",
+                          "type": "boolean"
+                        },
+                        "knexConfig": {
+                          "description": "Arbitrary config object to pass to knex when initializing\n(https://knexjs.org/#Installation-client). Most notable is the\ndebug and asyncStackTraces booleans.\n\nThis is merged recursively into the base knexConfig",
+                          "type": "object",
+                          "properties": {},
+                          "additionalProperties": true
+                        },
+                        "role": {
+                          "description": "Configures the ownership of newly created schemas in pg databases.",
+                          "type": "string"
+                        },
+                        "skipMigrations": {
+                          "description": "Skip running database migrations.",
+                          "type": "boolean"
+                        }
+                      }
+                    }
+                  }
+                },
+                "required": [
+                  "client",
+                  "connection"
+                ]
+              },
+              "cache": {
+                "description": "Cache connection configuration, select cache type using the `store` field",
+                "anyOf": [
+                  {
+                    "type": "object",
+                    "properties": {
+                      "store": {
+                        "type": "string",
+                        "const": "memory"
+                      },
+                      "defaultTtl": {
+                        "description": "An optional default TTL (in milliseconds)."
+                      }
+                    },
+                    "required": [
+                      "store"
+                    ]
+                  },
+                  {
+                    "type": "object",
+                    "properties": {
+                      "store": {
+                        "type": "string",
+                        "const": "redis"
+                      },
+                      "connection": {
+                        "description": "A redis connection string in the form `redis://user:pass@host:port`.",
+                        "visibility": "secret",
+                        "type": "string"
+                      },
+                      "defaultTtl": {
+                        "description": "An optional default TTL (in milliseconds)."
+                      },
+                      "useRedisSets": {
+                        "description": "Whether or not [useRedisSets](https://github.com/jaredwray/keyv/tree/main/packages/redis#useredissets) should be configured to this redis cache.\nDefaults to true if unspecified.",
+                        "type": "boolean"
+                      }
+                    },
+                    "required": [
+                      "connection",
+                      "store"
+                    ]
+                  },
+                  {
+                    "type": "object",
+                    "properties": {
+                      "store": {
+                        "type": "string",
+                        "const": "memcache"
+                      },
+                      "connection": {
+                        "description": "A memcache connection string in the form `user:pass@host:port`.",
+                        "visibility": "secret",
+                        "type": "string"
+                      },
+                      "defaultTtl": {
+                        "description": "An optional default TTL (in milliseconds)."
+                      }
+                    },
+                    "required": [
+                      "connection",
+                      "store"
+                    ]
+                  }
+                ]
+              },
+              "cors": {
+                "type": "object",
+                "properties": {
+                  "origin": {
+                    "anyOf": [
+                      {
+                        "type": "array",
+                        "items": {
+                          "type": "string"
+                        }
+                      },
+                      {
+                        "type": "string"
+                      }
+                    ]
+                  },
+                  "methods": {
+                    "anyOf": [
+                      {
+                        "type": "array",
+                        "items": {
+                          "type": "string"
+                        }
+                      },
+                      {
+                        "type": "string"
+                      }
+                    ]
+                  },
+                  "allowedHeaders": {
+                    "anyOf": [
+                      {
+                        "type": "array",
+                        "items": {
+                          "type": "string"
+                        }
+                      },
+                      {
+                        "type": "string"
+                      }
+                    ]
+                  },
+                  "exposedHeaders": {
+                    "anyOf": [
+                      {
+                        "type": "array",
+                        "items": {
+                          "type": "string"
+                        }
+                      },
+                      {
+                        "type": "string"
+                      }
+                    ]
+                  },
+                  "credentials": {
+                    "type": "boolean"
+                  },
+                  "maxAge": {
+                    "type": "number"
+                  },
+                  "preflightContinue": {
+                    "type": "boolean"
+                  },
+                  "optionsSuccessStatus": {
+                    "type": "number"
+                  }
+                }
+              },
+              "csp": {
+                "description": "Content Security Policy options.\n\nThe keys are the plain policy ID, e.g. \"upgrade-insecure-requests\". The\nvalues are on the format that the helmet library expects them, as an\narray of strings. There is also the special value false, which means to\nremove the default value that Backstage puts in place for that policy.",
+                "type": "object",
+                "additionalProperties": {
+                  "anyOf": [
+                    {
+                      "type": "array",
+                      "items": {
+                        "type": "string"
+                      }
+                    },
+                    {
+                      "const": false,
+                      "type": "boolean"
+                    }
+                  ]
+                }
+              },
+              "reading": {
+                "description": "Configuration related to URL reading, used for example for reading catalog info\nfiles, scaffolder templates, and techdocs content.",
+                "type": "object",
+                "properties": {
+                  "allow": {
+                    "description": "A list of targets to allow outgoing requests to. Users will be able to make\nrequests on behalf of the backend to the targets that are allowed by this list.",
+                    "type": "array",
+                    "items": {
+                      "type": "object",
+                      "properties": {
+                        "host": {
+                          "description": "A host to allow outgoing requests to, being either a full host or\na subdomain wildcard pattern with a leading `*`. For example `example.com`\nand `*.example.com` are valid values, `prod.*.example.com` is not.\nThe host may also contain a port, for example `example.com:8080`.",
+                          "type": "string"
+                        },
+                        "paths": {
+                          "description": "An optional list of paths. In case they are present only targets matching\nany of them will are allowed. You can use trailing slashes to make sure only\nsubdirectories are allowed, for example `/mydir/` will allow targets with\npaths like `/mydir/a` but will block paths like `/mydir2`.",
+                          "type": "array",
+                          "items": {
+                            "type": "string"
+                          }
                         }
+                      },
+                      "required": [
+                        "host"
                       ]
                     }
                   }
                 }
               }
-            }
+            },
+            "required": [
+              "baseUrl",
+              "database"
+            ]
           },
           "discovery": {
             "description": "Options used by the default discovery service.",
@@ -2506,6 +2582,9 @@
             ]
           }
         },
+        "required": [
+          "app"
+        ],
         "$schema": "http://json-schema.org/draft-07/schema#"
       }
     }