{
  "$schema": "https://json-schema.org/draft/2020-12/schema",
  "$id": "https://yovision.local/contracts/machine-identity/v1/principal-registry.schema.json",
  "title": "YoVision machine principal registry v1",
  "type": "object",
  "additionalProperties": false,
  "required": ["version", "audience", "principals"],
  "properties": {
    "version": {"const": "yovision.machine-principal-registry/v1"},
    "audience": {"enum": ["yovision-sense", "yovision-brain", "yovision-bell"]},
    "principals": {
      "type": "array",
      "items": {
        "type": "object",
        "additionalProperties": false,
        "required": ["principal_id", "enabled", "keys"],
        "properties": {
          "principal_id": {"type": "string", "pattern": "^yv:(sense|brain|bell):[a-z0-9][a-z0-9.-]{0,62}$"},
          "enabled": {"type": "boolean"},
          "keys": {
            "type": "array",
            "items": {
              "type": "object",
              "additionalProperties": false,
              "required": ["kid", "public_key_base64url", "status", "scopes"],
              "properties": {
                "kid": {"type": "string", "pattern": "^[A-Za-z0-9._-]{8,64}$"},
                "public_key_base64url": {"type": "string", "pattern": "^[A-Za-z0-9_-]{43}$"},
                "status": {"enum": ["active", "revoked"]},
                "scopes": {"type": "array", "minItems": 1, "maxItems": 4, "uniqueItems": true, "items": {"enum": ["source-config:write", "runtime-status:write", "events:ingest", "evidence:read"]}}
              }
            }
          }
        }
      }
    }
  }
}