{
  "$schema": "https://json-schema.org/draft/2020-12/schema",
  "$id": "urn:junexis:schema:trust-store:0.2",
  "title": "Magazyn zaufania Junexis 0.2",
  "description": "Rozszerza 0.1 o delegowaną rolę continuity-attestation. Nie zawiera prywatnego materiału.",
  "type": "object",
  "additionalProperties": false,
  "required": ["schemaVersion", "authority", "revision", "rootKeyId", "issuedAt", "expiresAt", "delegations"],
  "properties": {
    "schemaVersion": { "const": "junexis.trust-store/0.2" },
    "authority": { "const": "junexis-project" },
    "revision": { "type": "integer", "minimum": 1 },
    "rootKeyId": { "$ref": "#/$defs/keyId" },
    "issuedAt": { "$ref": "#/$defs/timestamp" },
    "expiresAt": { "$ref": "#/$defs/timestamp" },
    "delegations": {
      "type": "array",
      "minItems": 7,
      "maxItems": 256,
      "items": { "$ref": "#/$defs/delegation" },
      "allOf": [
        { "contains": { "properties": { "role": { "const": "registry-snapshot" } }, "required": ["role"] }, "minContains": 1 },
        { "contains": { "properties": { "role": { "const": "platform-release" } }, "required": ["role"] }, "minContains": 1 },
        { "contains": { "properties": { "role": { "const": "package-publisher" } }, "required": ["role"] }, "minContains": 1 },
        { "contains": { "properties": { "role": { "const": "provider-publisher" } }, "required": ["role"] }, "minContains": 1 },
        { "contains": { "properties": { "role": { "const": "channel-promotion" } }, "required": ["role"] }, "minContains": 1 },
        { "contains": { "properties": { "role": { "const": "revocation" } }, "required": ["role"] }, "minContains": 1 },
        { "contains": { "properties": { "role": { "const": "continuity-attestation" } }, "required": ["role"] }, "minContains": 1 }
      ]
    }
  },
  "$defs": {
    "keyId": { "type": "string", "pattern": "^sha256:[0-9a-f]{64}$" },
    "timestamp": {
      "type": "string",
      "pattern": "^[0-9]{4}-[0-9]{2}-[0-9]{2}T[0-9]{2}:[0-9]{2}:[0-9]{2}Z$"
    },
    "identifier": {
      "type": "string",
      "pattern": "^[a-z0-9][a-z0-9._:-]{1,127}$"
    },
    "identifierSet": {
      "type": "array",
      "minItems": 1,
      "maxItems": 128,
      "uniqueItems": true,
      "items": { "$ref": "#/$defs/identifier" }
    },
    "sourceIdSet": {
      "type": "array",
      "minItems": 1,
      "maxItems": 128,
      "uniqueItems": true,
      "items": { "type": "string", "pattern": "^[1-9][0-9]{0,38}$" }
    },
    "delegation": {
      "type": "object",
      "additionalProperties": false,
      "required": ["keyId", "role", "algorithm", "publicKeySpki", "notBefore", "notAfter", "scope"],
      "properties": {
        "keyId": { "$ref": "#/$defs/keyId" },
        "role": {
          "enum": [
            "registry-snapshot",
            "platform-release",
            "package-publisher",
            "provider-publisher",
            "channel-promotion",
            "revocation",
            "continuity-attestation"
          ]
        },
        "algorithm": { "const": "ecdsa-p256-sha256-der" },
        "publicKeySpki": {
          "type": "string",
          "pattern": "^[A-Za-z0-9+/]+={0,2}$",
          "minLength": 80,
          "maxLength": 256
        },
        "notBefore": { "$ref": "#/$defs/timestamp" },
        "notAfter": { "$ref": "#/$defs/timestamp" },
        "scope": { "type": "object" }
      },
      "allOf": [
        {
          "if": { "properties": { "role": { "const": "registry-snapshot" } }, "required": ["role"] },
          "then": { "properties": { "scope": { "$ref": "#/$defs/registryScope" } } }
        },
        {
          "if": { "properties": { "role": { "const": "platform-release" } }, "required": ["role"] },
          "then": { "properties": { "scope": { "$ref": "#/$defs/platformScope" } } }
        },
        {
          "if": { "properties": { "role": { "const": "package-publisher" } }, "required": ["role"] },
          "then": { "properties": { "scope": { "$ref": "#/$defs/packageScope" } } }
        },
        {
          "if": { "properties": { "role": { "const": "provider-publisher" } }, "required": ["role"] },
          "then": { "properties": { "scope": { "$ref": "#/$defs/providerScope" } } }
        },
        {
          "if": { "properties": { "role": { "const": "channel-promotion" } }, "required": ["role"] },
          "then": { "properties": { "scope": { "$ref": "#/$defs/promotionScope" } } }
        },
        {
          "if": { "properties": { "role": { "const": "revocation" } }, "required": ["role"] },
          "then": { "properties": { "scope": { "$ref": "#/$defs/revocationScope" } } }
        },
        {
          "if": { "properties": { "role": { "const": "continuity-attestation" } }, "required": ["role"] },
          "then": { "properties": { "scope": { "$ref": "#/$defs/continuityScope" } } }
        }
      ]
    },
    "registryScope": {
      "type": "object",
      "additionalProperties": false,
      "required": ["registryIds"],
      "properties": { "registryIds": { "$ref": "#/$defs/identifierSet" } }
    },
    "platformScope": {
      "type": "object",
      "additionalProperties": false,
      "required": ["components", "systems", "architectures"],
      "properties": {
        "components": { "$ref": "#/$defs/identifierSet" },
        "systems": {
          "type": "array",
          "minItems": 1,
          "uniqueItems": true,
          "items": { "enum": ["windows", "linux", "macos"] }
        },
        "architectures": {
          "type": "array",
          "minItems": 1,
          "uniqueItems": true,
          "items": { "enum": ["x64", "arm64"] }
        }
      }
    },
    "packageScope": {
      "type": "object",
      "additionalProperties": false,
      "required": ["namespaces"],
      "properties": {
        "namespaces": { "$ref": "#/$defs/identifierSet" },
        "packageIds": { "$ref": "#/$defs/identifierSet" }
      }
    },
    "providerScope": {
      "type": "object",
      "additionalProperties": false,
      "required": ["providerIds"],
      "properties": { "providerIds": { "$ref": "#/$defs/identifierSet" } }
    },
    "promotionScope": {
      "type": "object",
      "additionalProperties": false,
      "required": ["transitions"],
      "properties": {
        "transitions": {
          "type": "array",
          "minItems": 1,
          "maxItems": 2,
          "uniqueItems": true,
          "items": {
            "oneOf": [
              {
                "type": "object",
                "additionalProperties": false,
                "required": ["from", "to"],
                "properties": { "from": { "const": "dev" }, "to": { "const": "preview" } }
              },
              {
                "type": "object",
                "additionalProperties": false,
                "required": ["from", "to"],
                "properties": { "from": { "const": "preview" }, "to": { "const": "stable" } }
              }
            ]
          }
        }
      }
    },
    "revocationScope": {
      "type": "object",
      "additionalProperties": false,
      "required": ["kinds"],
      "properties": {
        "kinds": {
          "type": "array",
          "minItems": 1,
          "uniqueItems": true,
          "items": { "enum": ["security", "operational", "superseded"] }
        }
      }
    },
    "continuityScope": {
      "type": "object",
      "additionalProperties": false,
      "required": ["sourceIds"],
      "properties": { "sourceIds": { "$ref": "#/$defs/sourceIdSet" } }
    }
  }
}