{
  "$schema": "https://json-schema.org/draft/2020-12/schema",
  "$id": "https://standards.rootblocks.com/schemas/infra/infra-workflow.v1.schema.json",
  "title": "RootBlocks Infrastructure Workflow v1",
  "type": "object",
  "additionalProperties": false,
  "required": [
    "schemaVersion",
    "infraWorkflowId",
    "standard",
    "provider",
    "iacTool",
    "environment",
    "stateBackend",
    "driftPolicy",
    "resources",
    "operations",
    "gates",
    "sourceMaps",
    "evidence"
  ],
  "properties": {
    "schemaVersion": {
      "const": "rootblocks.infra-workflow/v1"
    },
    "infraWorkflowId": {
      "type": "string",
      "pattern": "^[a-z0-9][a-z0-9.-]{2,127}$"
    },
    "standard": {
      "$ref": "#/$defs/standardRef"
    },
    "provider": {
      "enum": ["azure", "aws", "gcp", "kubernetes", "custom"]
    },
    "iacTool": {
      "enum": ["terraform", "opentofu", "bicep", "pulumi", "cloud-native", "custom"]
    },
    "environment": {
      "enum": ["dev", "qa", "prod"]
    },
    "stateBackend": {
      "$ref": "#/$defs/stateBackend"
    },
    "driftPolicy": {
      "$ref": "#/$defs/driftPolicy"
    },
    "components": {
      "type": "array",
      "items": {
        "type": "string",
        "pattern": "^[a-z0-9][a-z0-9.-]{2,127}(@[0-9]+\\.[0-9]+\\.[0-9]+)?$"
      }
    },
    "resources": {
      "type": "array",
      "minItems": 1,
      "items": {
        "$ref": "#/$defs/resource"
      }
    },
    "operations": {
      "type": "array",
      "minItems": 1,
      "items": {
        "enum": ["validate", "plan", "apply", "drift", "backup", "destroy"]
      },
      "uniqueItems": true
    },
    "gates": {
      "type": "array",
      "items": {
        "$ref": "#/$defs/gate"
      }
    },
    "sourceMaps": {
      "type": "array",
      "minItems": 1,
      "items": {
        "$ref": "#/$defs/sourceMap"
      }
    },
    "secretRefs": {
      "type": "array",
      "items": {
        "$ref": "../security/secret-reference.v1.schema.json"
      }
    },
    "evidence": {
      "$ref": "#/$defs/evidencePolicy"
    }
  },
  "$defs": {
    "standardRef": {
      "type": "object",
      "additionalProperties": false,
      "required": ["bundleId", "version", "hash"],
      "properties": {
        "bundleId": {
          "type": "string",
          "pattern": "^[a-z0-9][a-z0-9.-]{2,127}$"
        },
        "version": {
          "type": "string",
          "pattern": "^(0|[1-9][0-9]*)\\.(0|[1-9][0-9]*)\\.(0|[1-9][0-9]*)(-[A-Za-z0-9.-]+)?(\\+[A-Za-z0-9.-]+)?$"
        },
        "hash": {
          "type": "string",
          "pattern": "^[a-f0-9]{64,128}$"
        }
      }
    },
    "gate": {
      "type": "object",
      "additionalProperties": false,
      "required": ["id", "type", "requiredFor"],
      "properties": {
        "id": {
          "type": "string",
          "pattern": "^[a-z0-9][a-z0-9.-]{2,127}$"
        },
        "type": {
          "enum": ["approval", "policy", "drift-check", "backup-required", "destructive-change", "health-check"]
        },
        "requiredFor": {
          "type": "array",
          "minItems": 1,
          "items": {
            "enum": ["plan", "apply", "destroy", "prod"]
          },
          "uniqueItems": true
        }
      }
    },
    "stateBackend": {
      "type": "object",
      "additionalProperties": false,
      "required": ["type", "path", "locking", "encryption"],
      "properties": {
        "type": {
          "enum": ["local-dev", "remote-state", "cloud-native", "custom"]
        },
        "path": {
          "type": "string",
          "minLength": 1,
          "maxLength": 500
        },
        "locking": {
          "const": true
        },
        "encryption": {
          "const": true
        }
      }
    },
    "driftPolicy": {
      "type": "object",
      "additionalProperties": false,
      "required": ["baselinePath", "detection", "onDrift"],
      "properties": {
        "baselinePath": {
          "type": "string",
          "pattern": "^builderx/drift/.+\\.drift-result\\.(json|yaml|yml)$"
        },
        "detection": {
          "enum": ["before-plan", "before-apply", "scheduled", "manual"]
        },
        "onDrift": {
          "enum": ["block", "warn", "remediate"]
        }
      }
    },
    "resource": {
      "type": "object",
      "additionalProperties": false,
      "required": ["id", "type", "name", "environmentScope", "lifecycle"],
      "properties": {
        "id": {
          "type": "string",
          "pattern": "^[a-z0-9][a-z0-9.-]{2,127}$"
        },
        "type": {
          "type": "string",
          "pattern": "^[a-z0-9][a-z0-9.-]{2,127}$"
        },
        "name": {
          "type": "string",
          "minLength": 1,
          "maxLength": 160
        },
        "environmentScope": {
          "type": "array",
          "minItems": 1,
          "items": {
            "enum": ["dev", "qa", "prod"]
          },
          "uniqueItems": true
        },
        "lifecycle": {
          "type": "array",
          "minItems": 1,
          "items": {
            "enum": ["create", "read", "update", "replace", "delete", "backup", "restore"]
          },
          "uniqueItems": true
        },
        "dependsOn": {
          "type": "array",
          "items": {
            "type": "string",
            "pattern": "^[a-z0-9][a-z0-9.-]{2,127}$"
          },
          "uniqueItems": true
        },
        "config": {
          "type": "object"
        },
        "secretRefs": {
          "type": "array",
          "items": {
            "$ref": "../security/secret-reference.v1.schema.json"
          }
        },
        "outputs": {
          "type": "array",
          "items": {
            "$ref": "#/$defs/resourceOutput"
          }
        },
        "backup": {
          "type": "object",
          "additionalProperties": false,
          "required": ["eligible", "defaultSelected", "retentionDays"],
          "properties": {
            "eligible": {
              "type": "boolean"
            },
            "defaultSelected": {
              "type": "boolean"
            },
            "retentionDays": {
              "type": "integer",
              "minimum": 0,
              "maximum": 3650
            },
            "policyRef": {
              "type": "string",
              "pattern": "^[a-z0-9][a-z0-9.-]{2,127}$"
            }
          }
        },
        "tags": {
          "type": "object",
          "additionalProperties": {
            "type": "string"
          }
        }
      }
    },
    "sourceMap": {
      "type": "object",
      "additionalProperties": false,
      "required": ["resourceId", "iacPath", "evidencePath"],
      "properties": {
        "resourceId": {
          "type": "string",
          "pattern": "^[a-z0-9][a-z0-9.-]{2,127}$"
        },
        "iacPath": {
          "type": "string",
          "pattern": "^infra/.+\\.(tf|tofu|bicep|yaml|yml|json|ts|py)$"
        },
        "blockId": {
          "type": "string",
          "minLength": 1
        },
        "evidencePath": {
          "type": "string",
          "pattern": "^evidence/.+\\.(json|yaml|yml)$"
        }
      }
    },
    "resourceOutput": {
      "type": "object",
      "additionalProperties": false,
      "required": ["name", "sensitive"],
      "properties": {
        "name": {
          "type": "string",
          "pattern": "^[a-z0-9][a-z0-9.-]{2,127}$"
        },
        "sensitive": {
          "type": "boolean"
        }
      }
    },
    "evidencePolicy": {
      "type": "object",
      "additionalProperties": false,
      "required": ["required", "events"],
      "properties": {
        "required": {
          "type": "boolean"
        },
        "events": {
          "type": "array",
          "items": {
            "enum": ["validated", "planned", "approved", "applied", "drift-detected", "backed-up", "destroyed", "failed"]
          },
          "uniqueItems": true
        }
      }
    }
  }
}