{
  "$schema": "https://json-schema.org/draft/2020-12/schema",
  "$id": "https://stella-ops.org/schemas/graph-demo-outputs.schema.json",
  "title": "StellaOps Graph Demo Outputs Schema",
  "description": "Schema for graph observability demo outputs, dashboard configurations, and metrics samples. Unblocks GRAPH-OPS-0001 (1+ tasks).",
  "type": "object",
  "definitions": {
    "DemoMetricSample": {
      "type": "object",
      "description": "Sample metric data for demo/documentation",
      "required": ["metric_name", "value", "timestamp"],
      "properties": {
        "metric_name": {
          "type": "string",
          "description": "Prometheus-style metric name"
        },
        "value": {
          "type": "number"
        },
        "timestamp": {
          "type": "string",
          "format": "date-time"
        },
        "labels": {
          "type": "object",
          "additionalProperties": {
            "type": "string"
          }
        },
        "unit": {
          "type": "string",
          "description": "Metric unit (bytes, seconds, count, etc.)"
        }
      }
    },
    "DemoTimeSeries": {
      "type": "object",
      "description": "Time series data for demo visualizations",
      "required": ["series_id", "metric_name", "data_points"],
      "properties": {
        "series_id": {
          "type": "string"
        },
        "metric_name": {
          "type": "string"
        },
        "labels": {
          "type": "object",
          "additionalProperties": {
            "type": "string"
          }
        },
        "data_points": {
          "type": "array",
          "items": {
            "type": "object",
            "properties": {
              "timestamp": {
                "type": "string",
                "format": "date-time"
              },
              "value": {
                "type": "number"
              }
            },
            "required": ["timestamp", "value"]
          }
        },
        "resolution": {
          "type": "string",
          "enum": ["1m", "5m", "15m", "1h", "1d"],
          "description": "Data point resolution"
        }
      }
    },
    "DemoDashboard": {
      "type": "object",
      "description": "Demo dashboard configuration",
      "required": ["dashboard_id", "title", "panels"],
      "properties": {
        "dashboard_id": {
          "type": "string"
        },
        "title": {
          "type": "string"
        },
        "description": {
          "type": "string"
        },
        "tags": {
          "type": "array",
          "items": {
            "type": "string"
          }
        },
        "time_range": {
          "type": "object",
          "properties": {
            "from": {
              "type": "string"
            },
            "to": {
              "type": "string"
            }
          }
        },
        "refresh_interval": {
          "type": "string",
          "default": "30s"
        },
        "panels": {
          "type": "array",
          "items": {
            "$ref": "#/definitions/DemoPanel"
          }
        },
        "variables": {
          "type": "array",
          "items": {
            "$ref": "#/definitions/DashboardVariable"
          }
        }
      }
    },
    "DemoPanel": {
      "type": "object",
      "description": "Dashboard panel configuration",
      "required": ["panel_id", "title", "type"],
      "properties": {
        "panel_id": {
          "type": "string"
        },
        "title": {
          "type": "string"
        },
        "description": {
          "type": "string"
        },
        "type": {
          "type": "string",
          "enum": ["graph", "stat", "gauge", "table", "heatmap", "logs", "alert_list", "pie_chart", "bar_chart"]
        },
        "grid_pos": {
          "type": "object",
          "properties": {
            "x": { "type": "integer" },
            "y": { "type": "integer" },
            "w": { "type": "integer" },
            "h": { "type": "integer" }
          }
        },
        "queries": {
          "type": "array",
          "items": {
            "$ref": "#/definitions/PanelQuery"
          }
        },
        "thresholds": {
          "type": "array",
          "items": {
            "$ref": "#/definitions/Threshold"
          }
        },
        "demo_data": {
          "$ref": "#/definitions/DemoTimeSeries",
          "description": "Pre-populated demo data for this panel"
        }
      }
    },
    "PanelQuery": {
      "type": "object",
      "description": "Panel query definition",
      "properties": {
        "query_id": {
          "type": "string"
        },
        "expr": {
          "type": "string",
          "description": "PromQL expression"
        },
        "legend": {
          "type": "string"
        },
        "datasource": {
          "type": "string"
        }
      }
    },
    "Threshold": {
      "type": "object",
      "description": "Visual threshold",
      "properties": {
        "value": {
          "type": "number"
        },
        "color": {
          "type": "string"
        },
        "state": {
          "type": "string",
          "enum": ["ok", "warning", "critical"]
        }
      }
    },
    "DashboardVariable": {
      "type": "object",
      "description": "Dashboard variable/filter",
      "required": ["name", "type"],
      "properties": {
        "name": {
          "type": "string"
        },
        "label": {
          "type": "string"
        },
        "type": {
          "type": "string",
          "enum": ["query", "custom", "constant", "interval"]
        },
        "options": {
          "type": "array",
          "items": {
            "type": "string"
          }
        },
        "default": {
          "type": "string"
        }
      }
    },
    "DemoAlertRule": {
      "type": "object",
      "description": "Demo alert rule",
      "required": ["rule_id", "name", "expr"],
      "properties": {
        "rule_id": {
          "type": "string"
        },
        "name": {
          "type": "string"
        },
        "expr": {
          "type": "string",
          "description": "PromQL alert expression"
        },
        "for": {
          "type": "string",
          "default": "5m",
          "description": "Duration condition must be true"
        },
        "severity": {
          "type": "string",
          "enum": ["critical", "warning", "info"]
        },
        "summary": {
          "type": "string"
        },
        "description": {
          "type": "string"
        },
        "runbook_url": {
          "type": "string",
          "format": "uri"
        },
        "labels": {
          "type": "object",
          "additionalProperties": {
            "type": "string"
          }
        },
        "annotations": {
          "type": "object",
          "additionalProperties": {
            "type": "string"
          }
        }
      }
    },
    "DemoRunbook": {
      "type": "object",
      "description": "Demo runbook configuration",
      "required": ["runbook_id", "title", "steps"],
      "properties": {
        "runbook_id": {
          "type": "string"
        },
        "title": {
          "type": "string"
        },
        "description": {
          "type": "string"
        },
        "trigger_alerts": {
          "type": "array",
          "items": {
            "type": "string"
          },
          "description": "Alert rule IDs that trigger this runbook"
        },
        "steps": {
          "type": "array",
          "items": {
            "$ref": "#/definitions/RunbookStep"
          }
        },
        "estimated_duration": {
          "type": "string",
          "description": "Estimated time to complete (e.g., 15m)"
        },
        "severity": {
          "type": "string",
          "enum": ["critical", "high", "medium", "low"]
        }
      }
    },
    "RunbookStep": {
      "type": "object",
      "description": "Individual runbook step",
      "required": ["step_number", "action"],
      "properties": {
        "step_number": {
          "type": "integer"
        },
        "action": {
          "type": "string",
          "description": "Action to perform"
        },
        "command": {
          "type": "string",
          "description": "CLI command if applicable"
        },
        "expected_outcome": {
          "type": "string"
        },
        "escalation_if_failed": {
          "type": "string"
        }
      }
    },
    "DemoOutputPack": {
      "type": "object",
      "description": "Complete demo output package",
      "required": ["pack_id", "version", "generated_at"],
      "properties": {
        "pack_id": {
          "type": "string"
        },
        "version": {
          "type": "string"
        },
        "generated_at": {
          "type": "string",
          "format": "date-time"
        },
        "dashboards": {
          "type": "array",
          "items": {
            "$ref": "#/definitions/DemoDashboard"
          }
        },
        "alert_rules": {
          "type": "array",
          "items": {
            "$ref": "#/definitions/DemoAlertRule"
          }
        },
        "runbooks": {
          "type": "array",
          "items": {
            "$ref": "#/definitions/DemoRunbook"
          }
        },
        "sample_data": {
          "type": "array",
          "items": {
            "$ref": "#/definitions/DemoTimeSeries"
          }
        },
        "screenshots": {
          "type": "array",
          "items": {
            "$ref": "#/definitions/DemoScreenshot"
          }
        },
        "aggregate_digest": {
          "type": "string",
          "pattern": "^sha256:[a-f0-9]{64}$"
        }
      }
    },
    "DemoScreenshot": {
      "type": "object",
      "description": "Demo screenshot for documentation",
      "required": ["screenshot_id", "filename", "digest"],
      "properties": {
        "screenshot_id": {
          "type": "string"
        },
        "filename": {
          "type": "string"
        },
        "description": {
          "type": "string"
        },
        "dashboard_id": {
          "type": "string",
          "description": "Dashboard this screenshot is from"
        },
        "panel_id": {
          "type": "string",
          "description": "Specific panel if applicable"
        },
        "width": {
          "type": "integer"
        },
        "height": {
          "type": "integer"
        },
        "format": {
          "type": "string",
          "enum": ["png", "webp", "svg"]
        },
        "digest": {
          "type": "string",
          "pattern": "^sha256:[a-f0-9]{64}$"
        }
      }
    }
  },
  "properties": {
    "output_pack": {
      "$ref": "#/definitions/DemoOutputPack"
    }
  },
  "examples": [
    {
      "output_pack": {
        "pack_id": "stellaops-graph-demo-2025.10",
        "version": "2025.10.0",
        "generated_at": "2025-12-06T10:00:00Z",
        "dashboards": [
          {
            "dashboard_id": "vulnerability-overview",
            "title": "Vulnerability Overview",
            "description": "High-level vulnerability metrics across all scanned assets",
            "tags": ["vulnerabilities", "overview"],
            "time_range": { "from": "now-24h", "to": "now" },
            "refresh_interval": "1m",
            "panels": [
              {
                "panel_id": "total-vulns",
                "title": "Total Vulnerabilities",
                "type": "stat",
                "grid_pos": { "x": 0, "y": 0, "w": 6, "h": 4 },
                "queries": [
                  {
                    "query_id": "q1",
                    "expr": "sum(stellaops_vulnerabilities_total)"
                  }
                ],
                "thresholds": [
                  { "value": 0, "color": "green", "state": "ok" },
                  { "value": 100, "color": "yellow", "state": "warning" },
                  { "value": 500, "color": "red", "state": "critical" }
                ]
              },
              {
                "panel_id": "critical-vulns",
                "title": "Critical Vulnerabilities",
                "type": "stat",
                "grid_pos": { "x": 6, "y": 0, "w": 6, "h": 4 },
                "queries": [
                  {
                    "query_id": "q2",
                    "expr": "sum(stellaops_vulnerabilities_total{severity=\"critical\"})"
                  }
                ]
              }
            ],
            "variables": [
              {
                "name": "tenant",
                "label": "Tenant",
                "type": "query",
                "options": ["all", "tenant-a", "tenant-b"]
              }
            ]
          }
        ],
        "alert_rules": [
          {
            "rule_id": "critical-vuln-spike",
            "name": "Critical Vulnerability Spike",
            "expr": "increase(stellaops_vulnerabilities_total{severity=\"critical\"}[1h]) > 10",
            "for": "5m",
            "severity": "critical",
            "summary": "Critical vulnerabilities increased by more than 10 in the last hour",
            "runbook_url": "https://docs.stella-ops.org/runbooks/critical-vuln-spike"
          }
        ],
        "runbooks": [
          {
            "runbook_id": "critical-vuln-spike-response",
            "title": "Critical Vulnerability Spike Response",
            "description": "Steps to investigate and respond to a spike in critical vulnerabilities",
            "trigger_alerts": ["critical-vuln-spike"],
            "steps": [
              {
                "step_number": 1,
                "action": "Identify the source of new vulnerabilities",
                "command": "stella findings list --severity critical --since 1h",
                "expected_outcome": "List of new critical findings with affected assets"
              },
              {
                "step_number": 2,
                "action": "Check if vulnerabilities are from new scans or advisory updates",
                "command": "stella scan jobs --status completed --since 1h"
              },
              {
                "step_number": 3,
                "action": "Review VEX applicability for affected components",
                "command": "stella vex check --vuln-id CVE-XXXX-YYYY"
              }
            ],
            "estimated_duration": "15m",
            "severity": "critical"
          }
        ],
        "sample_data": [
          {
            "series_id": "vulns-24h",
            "metric_name": "stellaops_vulnerabilities_total",
            "labels": { "severity": "critical" },
            "data_points": [
              { "timestamp": "2025-12-05T10:00:00Z", "value": 45 },
              { "timestamp": "2025-12-05T14:00:00Z", "value": 48 },
              { "timestamp": "2025-12-05T18:00:00Z", "value": 52 },
              { "timestamp": "2025-12-05T22:00:00Z", "value": 51 },
              { "timestamp": "2025-12-06T02:00:00Z", "value": 49 },
              { "timestamp": "2025-12-06T06:00:00Z", "value": 47 },
              { "timestamp": "2025-12-06T10:00:00Z", "value": 50 }
            ],
            "resolution": "1h"
          }
        ],
        "screenshots": [
          {
            "screenshot_id": "vuln-overview-full",
            "filename": "vulnerability-overview-dashboard.png",
            "description": "Full vulnerability overview dashboard",
            "dashboard_id": "vulnerability-overview",
            "width": 1920,
            "height": 1080,
            "format": "png",
            "digest": "sha256:scr123def456789012345678901234567890123456789012345678901234scr"
          }
        ],
        "aggregate_digest": "sha256:demo123def456789012345678901234567890123456789012345678901234demo"
      }
    }
  ]
}