{
  "$schema": "https://json-schema.org/draft/2020-12/schema",
  "$id": "urn:junexis:schema:platform-sbom:0.1",
  "title": "SBOM artefaktu platformy Junexis 0.1",
  "description": "Minimalny spis materiałowy oprogramowania dla jednego artefaktu wydania platformy. Nie zastępuje pełnego formatu SPDX/CycloneDX — jest zamkniętym podzbiorem wystarczającym dla bramki M18.",
  "type": "object",
  "additionalProperties": false,
  "required": ["schemaVersion", "component", "version", "subjectSha256", "components"],
  "properties": {
    "schemaVersion": { "const": "junexis.platform-sbom/0.1" },
    "component": { "$ref": "#/$defs/identifier" },
    "version": { "$ref": "#/$defs/semver" },
    "subjectSha256": { "$ref": "#/$defs/sha256" },
    "components": {
      "type": "array",
      "minItems": 1,
      "maxItems": 8192,
      "items": { "$ref": "#/$defs/componentEntry" }
    }
  },
  "$defs": {
    "identifier": { "type": "string", "pattern": "^[a-z0-9][a-z0-9._-]{1,127}$" },
    "semver": { "type": "string", "pattern": "^[0-9]+\\.[0-9]+\\.[0-9]+(?:[-+][0-9A-Za-z.-]+)?$" },
    "sha256": { "type": "string", "pattern": "^[0-9a-f]{64}(?![\\s\\S])" },
    "componentEntry": {
      "type": "object",
      "additionalProperties": false,
      "required": ["name", "version", "ecosystem", "license"],
      "properties": {
        "name": { "type": "string", "pattern": "^[A-Za-z0-9][A-Za-z0-9._@/-]{0,255}$" },
        "version": { "type": "string", "minLength": 1, "maxLength": 128 },
        "ecosystem": { "enum": ["nuget", "npm", "cargo", "pypi", "go", "vsix", "other"] },
        "license": { "type": "string", "minLength": 1, "maxLength": 128 },
        "sha256": { "$ref": "#/$defs/sha256" }
      }
    }
  }
}