{
  "$schema": "https://json-schema.org/draft/2020-12/schema",
  "$id": "https://stellaops.local/airgap/av-report.schema.json",
  "title": "Offline AV/YARA Scan Report",
  "type": "object",
  "additionalProperties": false,
  "required": ["scanner", "scannerVersion", "startedAt", "completedAt", "status", "artifacts"],
  "properties": {
    "scanner": { "type": "string" },
    "scannerVersion": { "type": "string" },
    "startedAt": { "type": "string", "format": "date-time" },
    "completedAt": { "type": "string", "format": "date-time" },
    "status": { "type": "string", "enum": ["clean", "findings", "error"] },
    "signature": { "type": "string", "description": "Optional detached signature over this report (base64)" },
    "artifacts": {
      "type": "array",
      "items": {
        "type": "object",
        "additionalProperties": false,
        "required": ["path", "sha256", "result"],
        "properties": {
          "path": { "type": "string" },
          "sha256": { "type": "string", "pattern": "^[A-Fa-f0-9]{64}$" },
          "result": { "type": "string", "enum": ["clean", "suspicious", "malicious", "error"] },
          "yaraRules": { "type": "array", "items": { "type": "string" }, "uniqueItems": true },
          "notes": { "type": "string" }
        }
      },
      "uniqueItems": true
    },
    "errors": {
      "type": "array",
      "items": { "type": "string" }
    }
  }
}