{
  "$schema": "https://json-schema.org/draft/2020-12/schema",
  "$id": "https://coredevpro.fr/schemas/cdp/v2.json",
  "title": "CoreDevPro Native Report Artifact",
  "description": "Public envelope for a CoreAnalyzer report and its independently verifiable origin proof.",
  "type": "object",
  "required": ["$schema", "version", "metadata", "proofs", "signature"],
  "properties": {
    "$schema": { "const": "https://coredevpro.fr/schemas/cdp/v2.json" },
    "version": { "type": "string", "pattern": "^2\\." },
    "metadata": {
      "type": "object",
      "required": ["artifact_id", "scan_id", "timestamp", "issuer", "integrity", "privacy", "compliance"],
      "properties": {
        "artifact_id": { "type": "string", "minLength": 1 },
        "scan_id": { "type": "string", "minLength": 1 },
        "timestamp": { "type": "string", "format": "date-time" },
        "issuer": {
          "type": "object",
          "required": ["name", "signing_key_id", "key_mode"],
          "properties": {
            "name": { "const": "CoreDevPro" },
            "signing_key_id": { "type": "string", "pattern": "^sha256:[a-f0-9]{64}$" },
            "key_mode": { "enum": ["coredevpro-configured", "ephemeral-dev"] }
          },
          "additionalProperties": true
        },
        "integrity": {
          "type": "object",
          "required": ["algorithm", "canonicalization", "signature_scope", "payload_sha256", "signing_key_id"],
          "properties": {
            "algorithm": { "const": "ECDSA-P256-SHA256" },
            "canonicalization": { "const": "CDP-CANONICAL-JSON-v1" },
            "signature_scope": { "const": "CDP-ORIGIN-STATEMENT-v1" },
            "payload_sha256": { "type": "string", "pattern": "^[a-f0-9]{64}$" },
            "signing_key_id": { "type": "string", "pattern": "^sha256:[a-f0-9]{64}$" }
          },
          "additionalProperties": false
        },
        "privacy": {
          "type": "object",
          "required": ["direct_personal_identifier", "account_email_embedded"],
          "properties": {
            "direct_personal_identifier": { "const": false },
            "account_email_embedded": { "const": false }
          },
          "additionalProperties": false
        },
        "compliance": {
          "type": "object",
          "required": ["origin_assurance", "timestamp_assurance", "eidas_qualified_status"],
          "properties": {
            "origin_assurance": { "enum": ["coredevpro-technical-seal", "self-signed-development"] },
            "timestamp_assurance": { "enum": ["declared-time-only", "external-token-present"] },
            "eidas_qualified_status": { "const": "not_claimed" }
          },
          "additionalProperties": false
        }
      },
      "additionalProperties": true
    },
    "proofs": {
      "type": "object",
      "required": ["origin"],
      "properties": {
        "origin": {
          "type": "object",
          "required": ["format", "key_id", "trust_registry"],
          "properties": {
            "format": { "const": "ECDSA-P256-SHA256" },
            "key_id": { "type": "string", "pattern": "^sha256:[a-f0-9]{64}$" },
            "trust_registry": { "const": "https://coredevpro.fr/api/v1/cdp/trust" },
            "public_key_pem": { "type": "string" }
          },
          "additionalProperties": false
        },
        "timestamp": {
          "type": "object",
          "description": "Optional detached RFC 3161 evidence. Qualification is established by validation, never by a declarative field alone.",
          "additionalProperties": true
        }
      },
      "additionalProperties": false
    },
    "payload": { "type": "object" },
    "encryption": {
      "type": "object",
      "required": ["enabled", "algorithm", "kdf", "aad", "iterations", "salt", "iv", "tag"],
      "properties": {
        "enabled": { "const": true },
        "algorithm": { "const": "AES-256-GCM" },
        "kdf": { "const": "PBKDF2-SHA256" },
        "aad": { "const": "CDP-PAYLOAD-SHA256-v1" },
        "iterations": { "type": "integer", "minimum": 100000, "maximum": 2000000 },
        "salt": { "type": "string", "minLength": 20 },
        "iv": { "type": "string", "minLength": 16 },
        "tag": { "type": "string", "minLength": 20 }
      },
      "additionalProperties": false
    },
    "payload_encrypted": { "type": "string", "minLength": 1 },
    "signature": {
      "type": "string",
      "minLength": 1,
      "description": "ECDSA P-256/SHA-256 signature of canonical JSON containing exactly {$schema, version, metadata, proofs: {origin}} from this artifact. metadata.integrity.payload_sha256 binds the clear or encrypted payload to that signed CDP-ORIGIN-STATEMENT-v1 projection."
    }
  },
  "oneOf": [
    { "required": ["payload"], "not": { "required": ["payload_encrypted"] } },
    { "required": ["encryption", "payload_encrypted"], "not": { "required": ["payload"] } }
  ],
  "additionalProperties": false
}