{
  "$schema": "https://json-schema.org/draft/2020-12/schema",
  "$id": "https://schemas.stella-ops.org/policy/policy-schema@1.json",
  "title": "StellaOps Policy Schema v1",
  "type": "object",
  "required": ["version", "rules"],
  "properties": {
    "version": {
      "type": ["string", "number"],
      "enum": ["1", "1.0", 1, 1.0]
    },
    "description": {
      "type": "string"
    },
    "metadata": {
      "type": "object",
      "additionalProperties": {
        "type": ["string", "number", "boolean"]
      }
    },
    "rules": {
      "type": "array",
      "minItems": 1,
      "items": {
        "$ref": "#/$defs/rule"
      }
    }
  },
  "additionalProperties": true,
  "$defs": {
    "identifier": {
      "type": "string",
      "minLength": 1
    },
    "severity": {
      "type": "string",
      "enum": ["Critical", "High", "Medium", "Low", "Informational", "None", "Unknown"]
    },
    "stringArray": {
      "type": "array",
      "items": {
        "type": "string",
        "minLength": 1
      },
      "uniqueItems": true
    },
    "rule": {
      "type": "object",
      "required": ["name", "action"],
      "properties": {
        "id": {
          "$ref": "#/$defs/identifier"
        },
        "name": {
          "type": "string",
          "minLength": 1
        },
        "description": {
          "type": "string"
        },
        "severity": {
          "type": "array",
          "items": {
            "$ref": "#/$defs/severity"
          },
          "uniqueItems": true
        },
        "sources": {
          "$ref": "#/$defs/stringArray"
        },
        "vendors": {
          "$ref": "#/$defs/stringArray"
        },
        "licenses": {
          "$ref": "#/$defs/stringArray"
        },
        "tags": {
          "$ref": "#/$defs/stringArray"
        },
        "environments": {
          "$ref": "#/$defs/stringArray"
        },
        "images": {
          "$ref": "#/$defs/stringArray"
        },
        "repositories": {
          "$ref": "#/$defs/stringArray"
        },
        "packages": {
          "$ref": "#/$defs/stringArray"
        },
        "purls": {
          "$ref": "#/$defs/stringArray"
        },
        "cves": {
          "$ref": "#/$defs/stringArray"
        },
        "paths": {
          "$ref": "#/$defs/stringArray"
        },
        "layerDigests": {
          "$ref": "#/$defs/stringArray"
        },
        "usedByEntrypoint": {
          "$ref": "#/$defs/stringArray"
        },
        "justification": {
          "type": "string"
        },
        "quiet": {
          "type": "boolean"
        },
        "action": {
          "oneOf": [
            {
              "type": "string",
              "enum": ["block", "fail", "deny", "ignore", "warn", "defer", "escalate", "requireVex"]
            },
            {
              "type": "object",
              "required": ["type"],
              "properties": {
                "type": {
                  "type": "string"
                },
                "quiet": {
                  "type": "boolean"
                },
                "until": {
                  "type": "string",
                  "format": "date-time"
                },
                "justification": {
                  "type": "string"
                },
                "severity": {
                  "$ref": "#/$defs/severity"
                },
                "vendors": {
                  "$ref": "#/$defs/stringArray"
                },
                "justifications": {
                  "$ref": "#/$defs/stringArray"
                },
                "epss": {
                  "type": "number",
                  "minimum": 0,
                  "maximum": 1
                },
                "kev": {
                  "type": "boolean"
                }
              },
              "additionalProperties": true
            }
          ]
        },
        "expires": {
          "type": "string",
          "format": "date-time"
        },
        "until": {
          "type": "string",
          "format": "date-time"
        },
        "metadata": {
          "type": "object",
          "additionalProperties": {
            "type": ["string", "number", "boolean"]
          }
        }
      },
      "additionalProperties": true
    }
  }
}
