{
  "$schema": "https://json-schema.org/draft/2020-12/schema",
  "$id": "urn:junexis:schema:trust-store:0.1",
  "title": "Magazyn zaufania Junexis 0.1",
  "description": "Oficjalna polityka delegująca rozdzielone role publikacji. Nie zawiera prywatnego materiału.",
  "type": "object",
  "additionalProperties": false,
  "required": [
    "schemaVersion",
    "authority",
    "revision",
    "rootKeyId",
    "issuedAt",
    "expiresAt",
    "delegations"
  ],
  "properties": {
    "schemaVersion": { "const": "junexis.trust-store/0.1" },
    "authority": { "const": "junexis-project" },
    "revision": { "type": "integer", "minimum": 1 },
    "rootKeyId": { "$ref": "#/$defs/keyId" },
    "issuedAt": { "$ref": "#/$defs/timestamp" },
    "expiresAt": { "$ref": "#/$defs/timestamp" },
    "delegations": {
      "type": "array",
      "minItems": 6,
      "maxItems": 256,
      "items": { "$ref": "#/$defs/delegation" },
      "allOf": [
        { "contains": { "properties": { "role": { "const": "registry-snapshot" } }, "required": ["role"] }, "minContains": 1 },
        { "contains": { "properties": { "role": { "const": "platform-release" } }, "required": ["role"] }, "minContains": 1 },
        { "contains": { "properties": { "role": { "const": "package-publisher" } }, "required": ["role"] }, "minContains": 1 },
        { "contains": { "properties": { "role": { "const": "provider-publisher" } }, "required": ["role"] }, "minContains": 1 },
        { "contains": { "properties": { "role": { "const": "channel-promotion" } }, "required": ["role"] }, "minContains": 1 },
        { "contains": { "properties": { "role": { "const": "revocation" } }, "required": ["role"] }, "minContains": 1 }
      ]
    }
  },
  "$defs": {
    "keyId": {
      "type": "string",
      "pattern": "^sha256:[0-9a-f]{64}$"
    },
    "timestamp": {
      "type": "string",
      "pattern": "^[0-9]{4}-[0-9]{2}-[0-9]{2}T[0-9]{2}:[0-9]{2}:[0-9]{2}Z$"
    },
    "identifier": {
      "type": "string",
      "pattern": "^[a-z0-9][a-z0-9._-]{1,127}$"
    },
    "identifierSet": {
      "type": "array",
      "minItems": 1,
      "maxItems": 128,
      "uniqueItems": true,
      "items": { "$ref": "#/$defs/identifier" }
    },
    "delegation": {
      "type": "object",
      "additionalProperties": false,
      "required": [
        "keyId",
        "role",
        "algorithm",
        "publicKeySpki",
        "notBefore",
        "notAfter",
        "scope"
      ],
      "properties": {
        "keyId": { "$ref": "#/$defs/keyId" },
        "role": {
          "enum": [
            "registry-snapshot",
            "platform-release",
            "package-publisher",
            "provider-publisher",
            "channel-promotion",
            "revocation"
          ]
        },
        "algorithm": { "const": "ecdsa-p256-sha256-der" },
        "publicKeySpki": {
          "type": "string",
          "pattern": "^[A-Za-z0-9+/]+={0,2}$",
          "minLength": 80,
          "maxLength": 256
        },
        "notBefore": { "$ref": "#/$defs/timestamp" },
        "notAfter": { "$ref": "#/$defs/timestamp" },
        "scope": { "type": "object" }
      },
      "allOf": [
        {
          "if": { "properties": { "role": { "const": "registry-snapshot" } }, "required": ["role"] },
          "then": { "properties": { "scope": { "$ref": "#/$defs/registryScope" } } }
        },
        {
          "if": { "properties": { "role": { "const": "platform-release" } }, "required": ["role"] },
          "then": { "properties": { "scope": { "$ref": "#/$defs/platformScope" } } }
        },
        {
          "if": { "properties": { "role": { "const": "package-publisher" } }, "required": ["role"] },
          "then": { "properties": { "scope": { "$ref": "#/$defs/packageScope" } } }
        },
        {
          "if": { "properties": { "role": { "const": "provider-publisher" } }, "required": ["role"] },
          "then": { "properties": { "scope": { "$ref": "#/$defs/providerScope" } } }
        },
        {
          "if": { "properties": { "role": { "const": "channel-promotion" } }, "required": ["role"] },
          "then": { "properties": { "scope": { "$ref": "#/$defs/promotionScope" } } }
        },
        {
          "if": { "properties": { "role": { "const": "revocation" } }, "required": ["role"] },
          "then": { "properties": { "scope": { "$ref": "#/$defs/revocationScope" } } }
        }
      ]
    },
    "registryScope": {
      "type": "object",
      "additionalProperties": false,
      "required": ["registryIds"],
      "properties": { "registryIds": { "$ref": "#/$defs/identifierSet" } }
    },
    "platformScope": {
      "type": "object",
      "additionalProperties": false,
      "required": ["components", "systems", "architectures"],
      "properties": {
        "components": { "$ref": "#/$defs/identifierSet" },
        "systems": {
          "type": "array",
          "minItems": 1,
          "uniqueItems": true,
          "items": { "enum": ["windows", "linux", "macos"] }
        },
        "architectures": {
          "type": "array",
          "minItems": 1,
          "uniqueItems": true,
          "items": { "enum": ["x64", "arm64"] }
        }
      }
    },
    "packageScope": {
      "type": "object",
      "additionalProperties": false,
      "required": ["namespaces"],
      "properties": {
        "namespaces": { "$ref": "#/$defs/identifierSet" },
        "packageIds": { "$ref": "#/$defs/identifierSet" }
      }
    },
    "providerScope": {
      "type": "object",
      "additionalProperties": false,
      "required": ["providerIds"],
      "properties": { "providerIds": { "$ref": "#/$defs/identifierSet" } }
    },
    "promotionScope": {
      "type": "object",
      "additionalProperties": false,
      "required": ["transitions"],
      "properties": {
        "transitions": {
          "type": "array",
          "minItems": 1,
          "maxItems": 2,
          "uniqueItems": true,
          "items": {
            "oneOf": [
              {
                "type": "object",
                "additionalProperties": false,
                "required": ["from", "to"],
                "properties": {
                  "from": { "const": "dev" },
                  "to": { "const": "preview" }
                }
              },
              {
                "type": "object",
                "additionalProperties": false,
                "required": ["from", "to"],
                "properties": {
                  "from": { "const": "preview" },
                  "to": { "const": "stable" }
                }
              }
            ]
          }
        }
      }
    },
    "revocationScope": {
      "type": "object",
      "additionalProperties": false,
      "required": ["kinds"],
      "properties": {
        "kinds": {
          "type": "array",
          "minItems": 1,
          "uniqueItems": true,
          "items": { "enum": ["security", "operational", "superseded"] }
        }
      }
    }
  }
}