{
  "$schema": "https://json-schema.org/draft/2020-12/schema",
  "$id": "https://standards.rootblocks.com/schemas/security/secret-reference.v1.schema.json",
  "title": "RootBlocks Secret Reference v1",
  "type": "object",
  "additionalProperties": false,
  "required": [
    "schemaVersion",
    "ref",
    "provider",
    "scope",
    "environment",
    "name"
  ],
  "properties": {
    "schemaVersion": {
      "const": "rootblocks.secret-reference/v1"
    },
    "ref": {
      "type": "string",
      "pattern": "^secret://(rootblocks|organization|project|personal)/(dev|qa|prod|shared)/[a-z0-9][a-z0-9.-]{1,127}$"
    },
    "provider": {
      "enum": [
        "azure-key-vault",
        "aws-secrets-manager",
        "gcp-secret-manager",
        "hashicorp-vault",
        "environment",
        "custom"
      ]
    },
    "scope": {
      "enum": ["organization", "project", "environment", "personal"]
    },
    "environment": {
      "enum": ["dev", "qa", "prod", "shared"]
    },
    "name": {
      "type": "string",
      "pattern": "^[a-z0-9][a-z0-9.-]{1,127}$"
    },
    "access": {
      "type": "object",
      "additionalProperties": false,
      "required": ["allowedOperations", "principalType", "resolutionMode", "auditRequired"],
      "properties": {
        "allowedOperations": {
          "type": "array",
          "minItems": 1,
          "items": {
            "enum": ["compile", "run", "debug", "deploy", "trace", "evidence"]
          },
          "uniqueItems": true
        },
        "principalType": {
          "enum": ["rootblocks-console", "builderx-runtime", "ci-runner", "agent", "human-operator", "custom"]
        },
        "resolutionMode": {
          "enum": ["runtime-only", "deploy-time", "ci-only", "manual-approval-required"]
        },
        "auditRequired": {
          "type": "boolean"
        }
      }
    },
    "redaction": {
      "type": "object",
      "additionalProperties": false,
      "required": ["policyRef", "redactInTraces", "redactInEvidence", "redactInLogs"],
      "properties": {
        "policyRef": {
          "type": "string",
          "pattern": "^[a-z0-9][a-z0-9.-]{2,127}$"
        },
        "redactInTraces": {
          "type": "boolean"
        },
        "redactInEvidence": {
          "type": "boolean"
        },
        "redactInLogs": {
          "type": "boolean"
        }
      }
    },
    "trustBoundary": {
      "type": "object",
      "additionalProperties": false,
      "required": ["owner", "consumer", "mcpScope"],
      "properties": {
        "owner": {
          "enum": ["rootblocks", "organization", "project", "personal"]
        },
        "consumer": {
          "enum": ["rootblocks-console", "builderx", "ci-runner", "agent", "custom"]
        },
        "mcpScope": {
          "enum": ["none", "read-reference-only", "resolve-dev", "resolve-qa", "resolve-prod"]
        }
      }
    },
    "required": {
      "type": "boolean",
      "default": true
    },
    "description": {
      "type": "string",
      "maxLength": 500
    }
  }
}